MuPDF CVE-2016-8728 Out of Bounds Write Heap Buffer Overflow Vulnerability

Bugtraq ID:	98699
Class:	Boundary Condition Error
CVE:	CVE-2016-8728
Remote:	Yes
Local:	No
Published:	May 15 2017 12:00AM
Updated:	May 15 2017 12:00AM
Credit:	Aleksandar Nikolic of Cisco Talos.
Vulnerable:	Artifex Mupdf 1.10-rc1
Not Vulnerable:

MuPDF CVE-2016-8728 Out of Bounds Write Heap Buffer Overflow Vulnerability

MuPDF is prone to a heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

MuPDF version 1.10-rc1 is vulnerable; other versions may also be vulnerable.

MuPDF CVE-2016-8728 Out of Bounds Write Heap Buffer Overflow Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

MuPDF CVE-2016-8728 Out of Bounds Write Heap Buffer Overflow Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

MuPDF CVE-2016-8728 Out of Bounds Write Heap Buffer Overflow Vulnerability

References:

• MuPDF Homepage (MuPDF)
  
• TALOS-2016-0242:MuPDF Fitz library font glyph scaling Code Execution Vulnerabili (Talos)