Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-6060: MuPDF 1.10a can be tricked by malicious image

CVE-2017-6060 · published 9 years ago

Summary

The MuPDF viewer version 1.10a may let a remote attacker send a specially crafted picture that could cause the program to behave unexpectedly, possibly crashing or exposing data. This risk affects systems running MuPDF on Linux, such as Debian installations. Update MuPDF to the latest version or apply any available security patches to protect your system.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
artifex	mupdf	1.10a `cpe:2.3:a:artifex:mupdf:1.10a:::::::*`
debian	debian_linux	9.0 `cpe:2.3:o:debian:debian_linux:9.0:::::::*`

Original advisory text

Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image.

References

https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=06a012a42c988...
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=e089b2e2c1d38...
http://www.openwall.com/lists/oss-security/2017/02/18/1 Exploit Mailing List Third Party Advisory
http://www.securityfocus.com/bid/96266 Broken Link
https://blogs.gentoo.org/ago/2017/02/17/mupdf-mujstest-stack-based-buffer-overfl... Exploit Issue Tracking Third Party Advisory VDB Entry
https://bugs.ghostscript.com/show_bug.cgi?id=697551 Exploit Third Party Advisory
https://security.gentoo.org/glsa/201706-08 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/09/msg00013.html Mailing List Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.8 High

Exploitation

7% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published15 Mar 2017

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-6060 · NVD

Track software like this

Free during beta