CVE-2017-5991
High · 7.5CVSS
7.5
EPSS
15.2%
Published
Feb 15, 2017
CISA due date
—
The record
An issue was discovered in Artifex MuPDF before 1912de5f08e90af1d9d0a9791f58ba3afdb9d465. The pdf_run_xobject function in pdf-op-run.c encounters a NULL pointer dereference during a Fitz fz_paint_pixmap_with_mask painting operation. Versions 1.11 and later are unaffected.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Alpine:v3.10 | mupdf | 0 | 1.10a-r2 |
| Alpine:v3.11 | mupdf | 0 | 1.10a-r2 |
| Alpine:v3.5 | mupdf | 0 | 1.10a-r2 |
| Alpine:v3.6 | mupdf | 0 | 1.10a-r2 |
| Alpine:v3.7 | mupdf | 0 | 1.10a-r2 |
| Alpine:v3.8 | mupdf | 0 | 1.10a-r2 |
| Alpine:v3.9 | mupdf | 0 | 1.10a-r2 |
| Debian:10 | mupdf | 0 | 1.9a+ds1-4 |
| Debian:11 | mupdf | 0 | 1.9a+ds1-4 |
| Debian:12 | mupdf | 0 | 1.9a+ds1-4 |
| Debian:13 | mupdf | 0 | 1.9a+ds1-4 |
| Debian:8 | mupdf | 0 | 1.5-1+deb8u2 |
| Mageia:5 | mupdf | 0 | 1.5-4.5.mga5 |
| Ubuntu:18.04:LTS | mupdf | 0 | 1.12.0+ds1-1 |
| Ubuntu:Pro:16.04:LTS | mupdf | 0 | No fix |
Related vulnerabilities
- CVE-2024-46657 Artifex Software mupdf v1.24.9 was discovered to contain a segmentation fault via the… Also affects mupdf
- CVE-2014-2013 Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF… Also affects mupdf
- CVE-2026-112405 Pillow is a Python imaging library. CWE-476
- CVE-2026-112392 Pillow is a Python imaging library. CWE-476
- CVE-2026-100348 kin-openapi is a Go project for handling OpenAPI files. CWE-476
- CVE-2026-100349 kin-openapi is a Go project for handling OpenAPI files. CWE-476
- CVE-2026-109280 ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx… CWE-476
- CVE-2026-109272 ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the… CWE-476