CVE-2017-15369

The build_filter_chain function in pdf/pdf-stream.c in Artifex MuPDF before 2017-09-25 mishandles...

7.8 High

CVE-2017-15369 is a high vulnerability (CVSS 7.8) in Artifex Mupdf, published October 16, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.28%, the 70th percentile. No source names a fixed version.

What does this mean?

Severity: 7.8 HighCVSS 3.0, NVD
Exploit chance: 1.28%EPSS, 70th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: No fix listedNo source names one

Description

The build_filter_chain function in pdf/pdf-stream.c in Artifex MuPDF before 2017-09-25 mishandles a certain case where a variable may reside in a register, which allows remote attackers to cause a denial of service (Fitz fz_drop_imp use-after-free and application crash) or possibly have unspecified other impact via a crafted PDF document.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.28%Up 0.3 points since Apr 14, 2021

Affected products

artifex mupdf

Affected packages

Affected packages
Package	Affected	Fixed
`mupdf` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.7-11.7a-11.7a-1ubuntu0.1~esm1	None known
`mupdf` openSUSE:Tumbleweed From an advisory covering 18 CVEs	before 1.18.0-1.7	1.18.0-1.7