mupdf: CVE-2020-16600

Debian Bug report logs - #989526
mupdf: CVE-2020-16600

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Bastian Germann <bastiangermann@fishpost.de>

To: submit@bugs.debian.org

Subject: mupdf: CVE-2020-16600

Date: Sun, 6 Jun 2021 12:40:04 +0200

Source: mupdf
Version: 1.14.0+ds1-4+deb10u2
Severity: normal
Tags: security buster patch upstream pending
Forwarded: https://bugs.ghostscript.com/show_bug.cgi?id=702253
X-Debbugs-Cc: team@security.debian.org

Hi,

The following vulnerability was published for mupdf.
It is already addressed in bullseye and sid.

I have prepared a NMU RFS with the fix for buster at #983104.

CVE-2020-16600[0]:
| A Use After Free vulnerability exists in Artifex Software, Inc. MuPDF library 1.17.0-rc1
| and earlier when a valid page was followed by a page with invalid pixmap dimensions,
| causing bander - a static - to point to previously freed memory instead of a newband_writer.

[0] https://security-tracker.debian.org/tracker/CVE-2020-16600
[1] https://bugs.ghostscript.com/show_bug.cgi?id=702253

Message #18 received at 989526-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 989526-submitter@bugs.debian.org

Subject: found 989526 in 1.14.0+ds1-4, closing 989526

Date: Sun, 06 Jun 2021 13:42:16 +0200

found 989526 1.14.0+ds1-4
close 989526 1.17.0+ds1-1
thanks

Send a report that this bug log contains spam.