Bug 634678 (CVE-2017-15587)

Summary:	<app-text/mupdf-1.12.0: integer overflow in pdf_read_new_xref_section
Product:	Gentoo Security	Reporter:	Aleksandr Wagner (Kivak) <alwag>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	vdupras, xmw
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://nandynarwhals.org/CVE-2017-15587/
Whiteboard:	B3 [glsa+ cve]
Package list:	app-text/mupdf-1.13.0	Runtime testing required:	---
Bug Depends on:	631970, 645948, 658618
Bug Blocks:

Description Aleksandr Wagner (Kivak) 2017-10-18 18:39:07 UTC

CVE-2017-15587 (https://nvd.nist.gov/vuln/detail/CVE-2017-15587):

An integer overflow was discovered in pdf_read_new_xref_section in pdf/pdf-xref.c in Artifex MuPDF 1.11.

References:

http://git.ghostscript.com/?p=mupdf.git;h=82df2631d7d0446b206ea6b434ea609b6c28b0e8
https://bugs.ghostscript.com/show_bug.cgi?id=698605
https://nandynarwhals.org/CVE-2017-15587/

Comment 1 Aaron Bauman (RETIRED) gentoo-dev

2018-03-28 23:33:10 UTC

@arches, please stabilize.

Comment 2 Aaron Bauman (RETIRED) gentoo-dev

2018-04-08 21:09:20 UTC

Really CC'ing arches this time...

Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev

2018-04-12 00:55:22 UTC

x86 stable

Comment 4 Sergei Trofimovich (RETIRED) gentoo-dev

2018-04-14 12:45:32 UTC

ia64 stable

Comment 5 Larry the Git Cow gentoo-dev

2018-04-14 14:54:29 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bcf75b3917cca220a320e7e8917c0fc8eea9428f

commit bcf75b3917cca220a320e7e8917c0fc8eea9428f
Author:     Aaron Bauman <bman@gentoo.org>
AuthorDate: 2018-04-14 14:45:38 +0000
Commit:     Aaron Bauman <bman@gentoo.org>
CommitDate: 2018-04-14 14:54:14 +0000

    app-text/mupdf: amd64 stable
    
    Bug: https://bugs.gentoo.org/634678
    Package-Manager: Portage-2.3.28, Repoman-2.3.9

 app-text/mupdf/mupdf-1.12.0-r2.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)}

Comment 6 Mikle Kolyada (RETIRED) archtester

2018-04-16 21:58:09 UTC

arm stable

Comment 7 Rolf Eike Beer archtester

2018-05-13 08:04:34 UTC

Sparc is blocked by bug 631970.

Comment 8 Tobias Klausmann (RETIRED) gentoo-dev

2018-05-14 11:50:02 UTC

Stable on alpha.

Comment 9 Stabilization helper bot gentoo-dev

2018-08-18 23:00:27 UTC

An automated check of this bug failed - the following atom is unknown:

app-text/mupdf-1.12.0-r2

Please verify the atom list.

Comment 10 Matt Turner gentoo-dev

2018-09-17 23:20:24 UTC

stablized app-text/mupdf-1.13.0 on ppc/ppc64 since the listed version is no longer in tree.

Comment 11 Aaron Bauman (RETIRED) gentoo-dev

2018-11-24 21:57:19 UTC

Added to GLSA.

Comment 12 GLSAMaker/CVETool Bot gentoo-dev

2018-11-26 18:34:54 UTC

This issue was resolved and addressed in
 GLSA 201811-15 at https://security.gentoo.org/glsa/201811-15
by GLSA coordinator Aaron Bauman (b-man).