FS#57486 : [mupdf] [llpp] [zathura-pdf-mupdf] multiple CVEs

FS#57486 - [mupdf] [llpp] [zathura-pdf-mupdf] multiple CVEs

Attached to Project: Community Packages
Opened by Morten Linderud (Foxboron) - Tuesday, 13 February 2018, 00:03 GMT
Last edited by Eli Schwartz (eschwartz) - Sunday, 13 May 2018, 13:01 GMT

Task Type	Bug Report
Category	Security
Status	Closed
Assigned To	Christian Hesse (eworm) Johannes Löthberg (demize) Levente Polyak (anthraxx) Eli Schwartz (eschwartz)
Architecture	All
Severity	High
Priority	Normal
Reported Version
Due in Version	Undecided
Due Date	Undecided
Percent Complete
Votes	0
Private	No

Details

Summary
=======

The package mupdf is vulnerable to multiple issues including arbitrary code execution and denial of service via CVE-2018-6544, CVE-2018-6192, CVE-2018-6187, CVE-2018-5686 and CVE-2018-1000051.

Guidance
========

No upstream releases yet.

References
==========

https://security.archlinux.org/AVG-609
https://bugs.ghostscript.com/show_bug.cgi?id=698965
https://bugs.ghostscript.com/show_bug.cgi?id=698830
http://git.ghostscript.com/?p=mupdf.git;h=b03def134988da8c800adac1a38a41a1f09a1d89
http://git.ghostscript.com/?p=mupdf.git;h=26527eef77b3e51c2258c8e40845bfbc015e405d
https://bugs.ghostscript.com/show_bug.cgi?id=698916
http://git.ghostscript.com/?p=mupdf.git;h=5e411a99604ff6be5db9e273ee84737204113299
https://bugs.ghostscript.com/show_bug.cgi?id=698908
http://git.ghostscript.com/?p=mupdf.git;h=3e30fbb7bf5efd88df431e366492356e7eb969ec
http://git.ghostscript.com/?p=mupdf.git;h=b70eb93f6936c03d8af52040bbca4d4a7db39079
https://bugs.ghostscript.com/show_bug.cgi?id=698860
https://bugs.ghostscript.com/show_bug.cgi?id=698825
https://bugs.ghostscript.com/show_bug.cgi?id=698873
http://www.ghostscript.com/cgi-bin/findgit.cgi?321ba1de287016b0036bf4a56ce774ad11763384

This task depends upon

Closed by Eli Schwartz (eschwartz)
Sunday, 13 May 2018, 13:01 GMT
Reason for closing: Fixed
Additional comments about closing: mupdf 1.13.0-1
llpp 27-2
zathura-pdf-mupdf 0.3.3-3

Comment by Eli Schwartz (eschwartz) - Thursday, 10 May 2018, 16:06 GMT

Field changed: Summary ([mupdf] [Security] multiple issues → [mupdf] [llpp] [zathura-pdf-mupdf] multiple CVEs)
Field changed: Category (Packages → Security)
Task reassigned to Levente Polyak (anthraxx), Christian Hesse (eworm), Levente Polyak (anthraxx), Eli Schwartz (eschwartz), Christian Hesse (eworm), Johannes Löthberg (demize)

And yep, we'll need to rebuild a couple packages which use libmupdf static libraries.

Comment by Eli Schwartz (eschwartz) - Thursday, 10 May 2018, 16:14 GMT

This should be fixed by mupdf 1.13.0-1 and llpp 27-2, right?

Still need a zathura-pdf-mupdf rebuild.

	Tasks related to this task (0)

Duplicate tasks of this task (0)

Arch Linux

FS#57486 - [mupdf] [llpp] [zathura-pdf-mupdf] multiple CVEs

Details

Loading...