Bug 1968638 (CVE-2020-16600)

Summary:	CVE-2020-16600 mupdf: use-after-free when a valid page was followed by a page with invalid pixmap dimensions
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mjg
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-28 05:29:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Guilherme de Almeida Suckevicz 2021-06-07 17:42:49 UTC

A Use After Free vulnerability exists in Artifex Software, Inc. MuPDF library 1.17.0-rc1 and earlier when a valid page was followed by a page with invalid pixmap dimensions, causing bander - a static - to point to previously freed memory instead of a newband_writer.

Reference:
https://bugs.ghostscript.com/show_bug.cgi?id=702253

Upstream patch:
http://git.ghostscript.com/?p=mupdf.git;h=96751b25462f83d6e16a9afaf8980b0c3f979c8b

Comment 1 Michael J Gruber 2021-06-07 19:46:51 UTC

I have no clue which OS or release this bug is for, but Fedora 32 and up have mupdf 1.18.0, Fedora 31 has mupdf 1.17.0 (all of which contain the fix); only Fedora 30 and below are affected (but EOLed since long).