Vulnerability · Published Oct 2, 2020 · Assigned by mitre
CVE-2020-26519
Medium 5.5
In plain English
A medium-severity security flaw in the mupdf package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)1.0%top 36.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Artifex MuPDF before 1.18.0 has a heap based buffer over-write when parsing JBIG2 files allowing attackers to cause a denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | mupdf | 1.17.0-r3 | ALPINE-CVE-2020-26519 |
| Alpine:v3.21 | mupdf | 1.17.0-r3 | ALPINE-CVE-2020-26519 |
| Alpine:v3.22 | mupdf | 1.17.0-r3 | ALPINE-CVE-2020-26519 |
| Alpine:v3.23 | mupdf | 1.17.0-r3 | ALPINE-CVE-2020-26519 |
| Alpine:v3.24 | mupdf | 1.17.0-r3 | ALPINE-CVE-2020-26519 |
| Debian:12 | mupdf | 1.17.0+ds1-1.1 | DEBIAN-CVE-2020-26519 |
| Debian:13 | mupdf | 1.17.0+ds1-1.1 | DEBIAN-CVE-2020-26519 |
| Debian:14 | mupdf | 1.17.0+ds1-1.1 | DEBIAN-CVE-2020-26519 |
Affected products (as reported)
References
- https://bugs.ghostscript.com/show_bug.cgi?id=702937 x_refsource_MISC
- http://git.ghostscript.com/?p=mupdf.git%3Ba=commit%3Bh=af1e390a2c7abceb32676ec684cd1dbb92907ce8 x_refsource_MISC
- FEDORA-2020-972ad7c8a8 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-3cea1ac8f3 vendor-advisory, x_refsource_FEDORA
- DSA-4794 vendor-advisory, x_refsource_DEBIAN
- [debian-lts-announce] 20210311 [SECURITY] [DLA 2589-1] mupdf security update mailing-list, x_refsource_MLIST
- GLSA-202105-30 vendor-advisory, x_refsource_GENTOO