{"schemaVersion":3,"id":"MGASA-2017-0479","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Updated mupdf packages fix security vulnerability\n\nMultiple vulnerabilities have been found in the PDF viewer MuPDF, which\nmay result in denial of service or the execution of arbitrary code if a\nmalformed PDF file is opened (CVE-2016-8674, CVE-2017-5896, CVE-2017-5991)\n\nTerry Chia and Jeremy Heng discovered an integer overflow that can cause\narbitrary code execution via a crafted .pdf file (CVE-2017-15587).","dates":{"published":"2017-12-31T12:00:06.000Z","modified":"2026-04-16T06:24:06.685Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"mageia","product":"mupdf","name":"mupdf","label":"mupdf","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/mupdf","purlType":"rpm","versions":[{"text":"< 1.5-4.5.mga5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5-4.5.mga5","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://advisories.mageia.org/MGASA-2017-0479.html","label":"advisories.mageia.org/MGASA-2017-0479.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20310","label":"bugs.mageia.org/show_bug.cgi?id=20310","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://www.debian.org/security/2017/dsa-3797","label":"www.debian.org/security/2017/dsa-3797","hostname":"www.debian.org","tags":["WEB"]},{"url":"https://www.debian.org/security/2017/dsa-4006","label":"www.debian.org/security/2017/dsa-4006","hostname":"www.debian.org","tags":["WEB"]}],"lineage":{"upstream":["CVE-2016-8674","CVE-2017-15587","CVE-2017-5896","CVE-2017-5991"],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2017-12-31T12:00:06.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-16T06:24:06.685Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T04:27:06.572Z","stale":false,"partial":false}}