Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 21 Jul 2016 10:09:20 -0400 (EDT)
From: cve-assign@...re.org
To: marco.gra@...il.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: mupdf library use after free

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> I disclosed a UAF in MuPDF, you can find the reproducer and report here:
> 
> http://bugs.ghostscript.com/show_bug.cgi?id=696941
> 
> mupdf ./mupdf_debug/build/debug/mupdf-x11 mucrash1.pdf
> 
> AddressSanitizer: heap-use-after-free ...
> READ of size 4
> 
> #0 0x6b0a53 in pdf_load_xref
> ... source/pdf/pdf-xref.c

Use CVE-2016-6265.

As far as we can tell, this is not yet referenced on the
http://git.ghostscript.com/?p=mupdf.git;a=shortlog page.

- -- 
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
  http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJXkNc6AAoJEHb/MwWLVhi24isQALZ8CLX1M0+Hva0aICremI3a
yyL7gQLxK/+Pda3uq20K1J/phQWGU4PUB8Xda1JHxJu6iAdxXvbXrarHtwdvUx5n
1axHjaEsFwVPh3jivU2Dy3mQuRomcSEYS8AojdAhNNC84z+DBEXroRi0ugS84AkN
IwRQTY3hAu9kV3Vq5wh2kKPBfUPSIq4X4l0+pulwahLzEZtPs2fUUiV+ft5T3UtU
lJuHz9n1nhiY0ScItic6fPu34U2iFT8CGSp/0Tigu8gIMkHkcoPIVK7cq1HhVMI4
gGgn0fLNa/6qldR1XLeRIK4rFWg5i5b5JxuPEVk4zQ3trFNUZT9PvMKoKJwNeTj7
s6k0yCOLBs0izrVBN66eD+zlgLywuaGzqfszuA7I+dUCB2bfeJV0/PEZS6hV6gSP
Csnimw7qPAf7c5Zw9NVtqsu3ojRq2GtWat/YoG31+z5lOlokfnkxRw6EheDjYmdM
wsS+aU211em9oO3pFgXtn6Rv/ipaloQFG2RwBEXdZb1hTuNkkoWWHdV9dn4RVCCC
VPX21ROUVd85KDd45yEliZOtqA65GdDoNmvzKOaYXZSsLbXI2ywKZ5GYWvguQfe7
TIfrkm4wqzWjVwWS93GpoJNpwc13gu+LJ3YfRND8U4klJPCzF/BxG/jqRk/4RaQu
ioc3SAefDUtrPooRl3g4
=4FHP
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.