Homepage

Resource Exhaustion The advisory has been revoked - it doesn't affect any version of package mupdf  (opens in a new tab)

Threat Intelligence

EPSS
1.57% (75th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1604-MUPDF-613994
  • published10 Sept 2020
  • disclosed6 Dec 2018
Report a new vulnerability Found a mistake?

Introduced: 6 Dec 2018

CVE-2018-19881  (opens in a new tab)
CWE-400  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:16.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream mupdf package and not the mupdf package as distributed by Ubuntu.

In Artifex MuPDF 1.14.0, svg/svg-run.c allows remote attackers to cause a denial of service (recursive calls followed by a fitz/xml.c fz_xml_att crash from excessive stack consumption) via a crafted svg file, as demonstrated by mupdf-gl.

References