Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the file pdf-stream.c of the component PDF Xref Loading. Executing a manipulation can lead to null pointer dereference. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e. Applying a patch is advised to resolve this issue.
The analysis looks flawed. the affected code has been introduced as recently as f3cf84aaac3c0a59854edc5af7fdad754577b97b which no released mupdf version carries. If there is a different code path triggering this, please specify the affected versions.
Indeed, the analysis is flawed in two directions and this dangerous: the flaw has been found exactly in b6d17493700c621c0e70036980a6ebd06d2202c9, and later "versions" *are affected as well* as long as they do not contain the fix from 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e. In contrast, "versions" before f3cf84aaac3c0a59854edc5af7fdad754577b97b do not contain the code which needed a fix (nor the fix, of course). In particular, no released mupdf has that code.
Thanks for the review. I verified the upstream source and release ancestry: - f3cf84aaac3c0a59854edc5af7fdad754577b97b introduced the external-stream path in pdf_open_filter(). - 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e changes its failure handling to throw. - The introduction commit is not present in upstream release tags. I also checked the pdf-stream.c source in the relevant 1.28.x releases; it does not contain that external-stream code. - Fedora Rawhide packages 1.28.2, with no downstream patch introducing this code. Therefore no Fedora-shipped MuPDF build is affected. The original affected-version analysis was incorrect. Let me know if you want me to close this as "not affected" or you will do it.