MuPDF 'pdf_shade4.c' Multiple Stack Buffer Overflow Vulnerabilities
BID:41818
Info
MuPDF 'pdf_shade4.c' Multiple Stack Buffer Overflow Vulnerabilities
| Bugtraq ID: | 41818 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2009-4117 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 28 2009 12:00AM |
| Updated: | Nov 28 2009 12:00AM |
| Credit: | Christophe Devine |
| Vulnerable: |
Krzysztof Kowalczyk Sumatra PDF 0.9.4 Krzysztof Kowalczyk Sumatra PDF 0.4 Krzysztof Kowalczyk Sumatra PDF 0.3 Krzysztof Kowalczyk Sumatra PDF 0.2 Krzysztof Kowalczyk Sumatra PDF 0.1 Artifex Mupdf 0 |
| Not Vulnerable: |
Krzysztof Kowalczyk Sumatra PDF 1.0.1 Artifex Mupdf 2009112523194 |
Discussion
MuPDF 'pdf_shade4.c' Multiple Stack Buffer Overflow Vulnerabilities
MuPDF is prone to multiple stack-based buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data.
An attacker can exploit these issues to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
Versions prior to MuPDF 20091125231942 are vulnerable.
Versions prior to Sumatra PDF 1.0.1 are vulnerable.
MuPDF is prone to multiple stack-based buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data.
An attacker can exploit these issues to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
Versions prior to MuPDF 20091125231942 are vulnerable.
Versions prior to Sumatra PDF 1.0.1 are vulnerable.
Exploit / POC
MuPDF 'pdf_shade4.c' Multiple Stack Buffer Overflow Vulnerabilities
An attacker must entice an unsuspecting victim into opening a malicious file.
An attacker must entice an unsuspecting victim into opening a malicious file.
Solution / Fix
MuPDF 'pdf_shade4.c' Multiple Stack Buffer Overflow Vulnerabilities
Solution:
Updates are available. Please the references for more information.
Solution:
Updates are available. Please the references for more information.
References
MuPDF 'pdf_shade4.c' Multiple Stack Buffer Overflow Vulnerabilities
References:
References:
- [Full-disclosure] MuPDF pdf_shade4.c multiple stack-based buffer overflows (Neohapsis)
- Daum Homepage (Daum)
- Official mupdf repository (ghostscript.com)
- Sumatra PDF Homepage (Krzysztof Kowalczyk)
- Sumatra PDF Version History (Krzysztof Kowalczyk)