CVE-2018-19881 Denial of service in n/a

Medium 5.5 Published 6 Dec 2018 Updated 16 Sep 2024

Remote attackers can cause a denial of service in MuPDF via crafted SVG files triggering excessive stack consumption.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2018-19881?

CVE-2018-19881 is a medium-severity denial of service vulnerability in Artifex Mupdf, published on 6 Dec 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

In Artifex MuPDF 1.14.0, svg/svg-run.c allows remote attackers to cause a denial of service (recursive calls followed by a fitz/xml.c fz_xml_att crash from excessive stack consumption) via a crafted svg file, as demonstrated by mupdf-gl.

Weakness: CWE-400

Which versions are affected by CVE-2018-19881?

It affects 1 product.

Products include Artifex Mupdf.

How do I fix CVE-2018-19881?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2018-19881 being exploited?

There is no known exploitation of CVE-2018-19881 in the wild and no public exploit code.

All Artifex Mupdf vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-19881, GHSA-9v5c-3867-7h2w.