Denial of Service in Artifex MuPDF Affects Multiple Versions

CVE-2018-19881

What is CVE-2018-19881?

In Artifex MuPDF, specifically version 1.14.0, a vulnerability has been identified that can allow remote attackers to execute a denial of service attack. This is achieved by sending specially crafted SVG files that trigger recursive function calls leading to excessive stack consumption. The exploitation of this vulnerability can result in crashes due to a fz_xml_att failure in the library's XML handling functionality, potentially rendering the service unavailable. It's essential for users of this version to apply relevant security patches to mitigate the risks associated with this vulnerability.

References