Heap-Based Buffer Over-Read in Artifex MuPDF Affected by Missing String Check
CVE-2019-14975

7.1HIGH

Key Information:

Vendor
Artifex
Status
MuPDF
Vendor
CVE Published:
14 August 2019

Summary

Artifex MuPDF versions before 1.16.0 are susceptible to a heap-based buffer over-read due to inadequate validation of strings in certain PDF operations. This vulnerability emerges from the 'fz_chartorune' function in 'fitz/string.c,' which does not appropriately handle cases where a string might be absent. As a result, potential attackers could exploit this flaw to execute unexpected behaviors, potentially leading to data disclosure or integrity issues. Users are encouraged to upgrade to the latest version to mitigate risks associated with this vulnerability.

References

https://bugs.ghostscript.com/show_bug.cgi?id=701292
x_refsource_MISC
http://git.ghostscript.com/?p=mupdf.git%3Ba=commit%3Bh=97...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.