CVE-2020-26519

moderate-risk
Published 2020-10-02

Artifex MuPDF before 1.18.0 has a heap based buffer over-write when parsing JBIG2 files allowing attackers to cause a denial of service.

Do I need to act?

-
0.77% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (5)

Affected Vendors

Debian Fedoraproject Artifex

References (14)

http://git.ghostscript.com/?p=mupdf.git%3Ba=commit%3Bh=af1e390a2c7abceb32676ec68...
Permissions Required https://bugs.ghostscript.com/show_bug.cgi?id=702937
Mailing List https://lists.debian.org/debian-lts-announce/2021/03/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://security.gentoo.org/glsa/202105-30
Third Party Advisory https://www.debian.org/security/2020/dsa-4794
http://git.ghostscript.com/?p=mupdf.git%3Ba=commit%3Bh=af1e390a2c7abceb32676ec68...
Permissions Required https://bugs.ghostscript.com/show_bug.cgi?id=702937
Mailing List https://lists.debian.org/debian-lts-announce/2021/03/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://security.gentoo.org/glsa/202105-30
Third Party Advisory https://www.debian.org/security/2020/dsa-4794
33
/ 100
moderate-risk
Severity 18/34 · Moderate
Exploitability 3/34 · Minimal
Exposure 12/34 · Low