CVE-2017-17858

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Heap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote attacker to potentially execute arbitrary code via a crafted PDF file, because xref subsection object numbers are unrestricted.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.ghostscript.com/?p=mupdf.git%3Ba=commit%3Bh=55c3f68d638ac1263a386e0aaa004bb6e8bde731
https://bugs.ghostscript.com/show_bug.cgi?id=698819Permissions Required
https://github.com/mzet-/Security-Advisories/blob/master/mzet-adv-2017-01.mdExploit, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201811-15
http://git.ghostscript.com/?p=mupdf.git%3Ba=commit%3Bh=55c3f68d638ac1263a386e0aaa004bb6e8bde731
https://bugs.ghostscript.com/show_bug.cgi?id=698819Permissions Required
https://github.com/mzet-/Security-Advisories/blob/master/mzet-adv-2017-01.mdExploit, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201811-15

Timeline

Published: Jan 22, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-178596.1Samsung Internet Browser 6.2.01.12 allows remote attackers to bypass the Same Origin Policy, and conduct UXSS attacks to obtain sensitive in CVE-2017-17865.3IBM WebSphere MQ 8.0 through 8.0.0.8 and 9.0 through 9.0.4 under special circumstances could allow an authenticated user to consume all reso CVE-2017-178605.7In Samsung Gear products, Bluetooth link key is updated to the different key which is same with attacker's link key. It can be attacked with CVE-2017-178625.5kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would still be processed by JIT compilers.CVE-2017-178637.8kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, whi CVE-2017-178643.3kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_V CVE-2017-178667.8pdf/pdf-write.c in Artifex MuPDF before 1.12.0 mishandles certain length changes when a repair operation occurs during a clean operation, wh CVE-2017-178678.8Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field CVE-2017-178686.1In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter (p_r_p) value, as demonstrated by p_r_p_564233524_tag.CVE-2017-178696.1The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter.CVE-2017-17876.7IBM Publishing Engine 2.1.2 and 6.0.5 contains an undisclosed vulnerability that could allow a local user with administrative privileges to CVE-2017-178709.8The JBuildozer extension 1.4.1 for Joomla! has SQL Injection via the appid parameter in an entriessearch action.