[Secure-testing-team] Bug#840957: mupdf: CVE-2016-8674: heap-use-after-free

[Salvatore Bonaccorso]

Source: mupdf
Version: 1.5-1
Severity: grave
Tags: security upstream patch

Hi,

the following vulnerability was published for mupdf.

CVE-2016-8674[0]:
heap-use-after-free

The issue is reproducible with src:mupdf compiled with ASAN, and two
reproducers are available on the two referenced bugs below.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-8674
[1] https://marc.info/?l=oss-security&m=147658659118554&w=2
[2] https://blogs.gentoo.org/ago/2016/09/22/mupdf-use-after-free-in-pdf_to_num-pdf-object-c/
[3] http://bugs.ghostscript.com/show_bug.cgi?id=697015
[4] http://bugs.ghostscript.com/show_bug.cgi?id=697019
[5] http://git.ghostscript.com/?p=mupdf.git;h=1e03c06456d997435019fb3526fa2d4be7dbc6ec

Regards,
Salvatore