CveMateVulnerability intelligence

Artifex vulnerabilities, page 2

261 vulnerabilities

Known vulnerabilities in Artifex products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 12 products.

CVE-2018-1000039artifexmupdf+28y ago24-05-2018 13:00

In Artifex MuPDF 1.12.0 and earlier, multiple heap use after free bugs in the PDF parser could allow an attacker to execute arbitrary code, read memory, or cause a denial of service via a crafted file.CVE-2018-19777artifexmupdf+37y ago30-11-2018 09:00

In Artifex MuPDF 1.14.0, there is an infinite loop in the function svg_dev_end_tile in fitz/svg-device.c, as demonstrated by mutool.CVE-2018-19475alpineghostscript+127y ago23-11-2018 05:00

psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same.CVE-2018-19477alpineghostscript+127y ago23-11-2018 05:00

psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode type confusion.CVE-2018-19478artifexghostscript+37y ago02-01-2019 18:00

In Artifex Ghostscript before 9.26, a carefully crafted PDF file can trigger an extremely long running computation when parsing the file.CVE-2018-19882artifexmupdf+27y ago06-12-2018 00:00

In Artifex MuPDF 1.14.0, the svg_run_image function in svg/svg-run.c allows remote attackers to cause a denial of service (href_att NULL pointer dereference and application crash) via a crafted svg file, as demonstrated by mupdf-gl.CVE-2018-19134artifexghostscript+87y ago20-12-2018 22:00

In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.CVE-2018-19409alpineghostscript+107y ago21-11-2018 16:00

An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used.CVE-2018-19476alpineghostscript+127y ago23-11-2018 05:00

psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type confusion.CVE-2018-19881artifexmupdf+17y ago06-12-2018 00:00

In Artifex MuPDF 1.14.0, svg/svg-run.c allows remote attackers to cause a denial of service (recursive calls followed by a fitz/xml.c fz_xml_att crash from excessive stack consumption) via a crafted svg file, as demonstrated by mupdf-gl.CVE-2018-11645artifexghostscript+98y ago01-06-2018 12:00

psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.CVE-2018-17183artifexghostscript+108y ago19-09-2018 15:00

Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code.CVE-2018-17961alpineghostscript+118y ago15-10-2018 16:00

Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE-2018-17183.CVE-2018-18662artifexmupdf+27y ago26-10-2018 13:00

There is an out-of-bounds read in fz_run_t3_glyph in fitz/font.c in Artifex MuPDF 1.14.0, as demonstrated by mutool.CVE-2018-18284alpineghostscript+138y ago19-10-2018 22:00

Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.CVE-2018-18073alpineghostscript+118y ago15-10-2018 16:00

Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object.CVE-2018-5759artifexmujs8y ago24-01-2018 21:00

jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows remote attackers to cause a denial of service (excessive recursion) via a crafted file.CVE-2018-5686alpinemupdf+48y ago14-01-2018 02:00

In MuPDF 1.12.0, there is an infinite loop vulnerability and application hang in the pdf_parse_array function (pdf/pdf-parse.c) because EOF is not considered. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file.CVE-2018-10289artifexmupdf+38y ago22-04-2018 05:00

In MuPDF 1.13.0, there is an infinite loop in the fz_skip_space function of the pdf/pdf-xref.c file. A remote adversary could leverage this vulnerability to cause a denial of service via a crafted pdf file.CVE-2018-10194alpineghostscript+198y ago18-04-2018 21:00

The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.