CVE-2023-31794 Denial of service in n/a

What is CVE-2023-31794?

CVE-2023-31794 is a medium-severity denial of service vulnerability in Artifex Mupdf, published on 31 Oct 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

MuPDF v1.21.1 was discovered to contain an infinite recursion in the component pdf_mark_list_push. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

Weakness: CWE-674

Which versions are affected by CVE-2023-31794?

It affects 1 product.

Products include Artifex Mupdf.

How do I fix CVE-2023-31794?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-31794 being exploited?

There is no known exploitation of CVE-2023-31794 in the wild and no public exploit code.

Other vulnerabilities in Artifex Mupdf

• CVE-2019-7321 Memory corruption in n/a Critical 9.8
• CVE-2016-6525 Memory corruption in n/a Critical 9.8
• CVE-2011-0341 Memory corruption in n/a Critical 9.3
• CVE-2016-8728 Memory corruption in MuPDF High 8.6
• CVE-2021-3407 Use after free in mupdf High 7.8

All Artifex Mupdf vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-31794, GHSA-fp46-48v5-9hqr, openSUSE-SU-2023:0363-1, openSUSE-SU-2024:13404-1.