CVE-2020-26519

Name
CVE-2020-26519
Description
Artifex MuPDF before 1.18.0 has a heap based buffer over-write when parsing JBIG2 files allowing attackers to cause a denial of service.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Mailing List http://git.ghostscript.com/?p=mupdf.git;a=commit;h=af1e390a2c7abceb32676ec684cd1dbb92907ce8
Permissions Required https://bugs.ghostscript.com/show_bug.cgi?id=702937
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WJMBKWVY7ZBIQV3EU5YHEFH5XWV4PABG/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SOF4PX2A5TGKKPMXINADSOJJ4H5UUMKK/
Third Party Advisory https://www.debian.org/security/2020/dsa-4794
Mailing List https://lists.debian.org/debian-lts-announce/2021/03/msg00012.html
GENTOO https://security.gentoo.org/glsa/202105-30

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:* mupdf >= None < 1.18.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
mupdf edge-community 1.17.0-r3 None fixed
mupdf edge-community 1.13-r0 None possibly vulnerable
mupdf edge-community 1.11-r1 None possibly vulnerable
mupdf edge-community 1.10a-r2 None possibly vulnerable
mupdf edge-community 1.10a-r1 None possibly vulnerable
mupdf 3.22-community 1.17.0-r3 None fixed
mupdf 3.22-community 1.13-r0 None possibly vulnerable
mupdf 3.22-community 1.11-r1 None possibly vulnerable
mupdf 3.22-community 1.10a-r2 None possibly vulnerable
mupdf 3.22-community 1.10a-r1 None possibly vulnerable
mupdf 3.21-community 1.17.0-r3 None fixed
mupdf 3.20-community 1.17.0-r3 None fixed
mupdf 3.19-community 1.17.0-r3 None fixed
mupdf 3.18-community 1.17.0-r3 None fixed
mupdf 3.17-community 1.17.0-r3 None fixed
mupdf 3.11-main 1.16.1-r1 Daniel Sabogal <dsabogalcc@gmail.com> possibly vulnerable
mupdf 3.10-main 1.15.0-r0 Daniel Sabogal <dsabogalcc@gmail.com> possibly vulnerable