CVE-2019-13290

Artifex MuPDF 1.15.0 has a heap-based buffer overflow in fz_append_display_node located at fitz/list-device.c, allowing remote attackers to execute arbitrary code via a crafted PDF file. This occurs with a large BDC property name that overflows the allocated size of a display list node.
Configurations

Configuration 1 (hide)

cpe:2.3:a:artifex:mupdf:1.15.0:*:*:*:*:*:*:*

History

07 Nov 2023, 03:03

Type Values Removed Values Added
References
  • {'url': 'http://git.ghostscript.com/?p=mupdf.git;h=ed19bc806809ad10c4ddce515d375581b86ede85', 'name': 'http://git.ghostscript.com/?p=mupdf.git;h=ed19bc806809ad10c4ddce515d375581b86ede85', 'tags': ['Patch', 'Third Party Advisory'], 'refsource': 'MISC'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUXKCY35PKC32IFHN4RBUCZ75OWEYVJH/', 'name': 'FEDORA-2019-10f02ad597', 'tags': [], 'refsource': 'FEDORA'}
  • {'url': 'http://git.ghostscript.com/?p=mupdf.git;h=aaf794439e40a2ef544f15b50c20e657414dec7a', 'name': 'http://git.ghostscript.com/?p=mupdf.git;h=aaf794439e40a2ef544f15b50c20e657414dec7a', 'tags': ['Patch', 'Third Party Advisory'], 'refsource': 'MISC'}
  • () http://git.ghostscript.com/?p=mupdf.git%3Bh=aaf794439e40a2ef544f15b50c20e657414dec7a -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUXKCY35PKC32IFHN4RBUCZ75OWEYVJH/ -
  • () http://git.ghostscript.com/?p=mupdf.git%3Bh=ed19bc806809ad10c4ddce515d375581b86ede85 -

Information

Published : 2019-07-04 22:15

Updated : 2023-12-10 12:59


NVD link : CVE-2019-13290

Mitre link : CVE-2019-13290

CVE.ORG link : CVE-2019-13290


JSON object : View

Products Affected

artifex

  • mupdf
CWE
CWE-787

Out-of-bounds Write