MuPDF up to 1.12.0 pdf/pdf-cmap.c pdf_lookup_cmap_full memory corruption

Summaryinfo

A vulnerability was found in MuPDF up to 1.12.0. It has been classified as critical. This vulnerability affects the function pdf_lookup_cmap_full of the file pdf/pdf-cmap.c. This manipulation causes memory corruption. This vulnerability is registered as CVE-2018-1000038. The attack needs to be launched locally. No exploit is available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability has been found in MuPDF up to 1.12.0 (Document Reader Software) and classified as critical. Affected by this vulnerability is the function pdf_lookup_cmap_full of the file pdf/pdf-cmap.c. The manipulation with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In MuPDF 1.12.0 and earlier, a stack buffer overflow in function pdf_lookup_cmap_full in pdf/pdf-cmap.c could allow an attacker to execute arbitrary code via a crafted file.

The bug was discovered 01/23/2018. The weakness was published 05/24/2018 as confirmed git commit (GIT Repository). The advisory is shared at git.ghostscript.com. This vulnerability is known as CVE-2018-1000038 since 02/02/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 121 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 119160 (GLSA-201811-15 : MuPDF: Multiple vulnerabilities), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Gentoo Local Security Checks and running in the context l.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.ghostscript.com. A possible mitigation has been published 7 months after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (119160). Similar entries are available at VDB-118166, VDB-118163, VDB-118164 and VDB-118167. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Document Reader Software

Name

• MuPDF

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion