CVE-2016-8729

Published: Apr 24, 2018Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

An exploitable memory corruption vulnerability exists in the JBIG2 parser of Artifex MuPDF 1.9. A specially crafted PDF can cause a negative number to be passed to a memset resulting in memory corruption and potential code execution. An attacker can specially craft a PDF and send to the victim to trigger this vulnerability.

Affected (1)

Products: Artifex: Mupdf

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Artifex Mupdf	Version 1.9

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (5)

https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0243

Source: talos-cna@cisco.com

Third Party Advisory

https://bugs.ghostscript.com/show_bug.cgi?id=697395

Source: af854a3a-2127-422b-91ae-364da2661108

https://cgit.ghostscript.com/cgi-bin/cgit.cgi/jbig2dec.git/commit/?id=e698d5c11d27212aa1098bc5b1673a3378563092

Source: af854a3a-2127-422b-91ae-364da2661108

https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=1a7ef61410884daff8ff8391ddcecc3102acd989

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0243

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.