CVE-2017-14687

Artifex MuPDF before version 1.12.0 mishandles certain length changes during a repair operation in pdf/pdf-write.c, which can lead to buffer overflow and application crash.

An integer overflow was discovered in pdf_read_new_xref_section in Artifex MuPDF 1.11.

The build_filter_chain function in pdf/pdf-stream.c in Artifex MuPDF before September 25, 2017, mishandles a case where a variable may reside in a register. This allows remote attackers to cause a denial of service or possibly other unspecified impacts via a crafted PDF document.

Artifex MuPDF version 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. The issue arises from the lack of checks for negative size fields in a ZIP entry.

Artifex MuPDF version 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. The issue is related to the xps_load_links_in_glyphs function, which does not verify that an xps font could be loaded.

A vulnerability was detected in Artifex MuPDF in the free_char_list function (source/pdf/pdf-xref.c) within the Signature Locking component. The manipulation results in a double free. The exploit is public and can be initiated remotely; a patch named 3984925b660afb8a781ddf504021e91be1bc671e is available.

A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9 in the function pdf_open_filter of the file pdf-stream.c of the PDF Xref Loading component. Executing a manipulation can lead to a null pointer dereference, and the attack can be launched remotely.

A vulnerability was found in Artifex MuPDF, specifically an out-of-bounds read in the fz_subset_cff_for_gids function of subset-cff.c, which handles CFF indexes. The attack requires local access, and the exploit has been publicly disclosed. The project was notified but has not responded.