Source: mupdf Version: 1.14.0+ds1-4+deb10u2 Severity: normal Tags: security buster patch upstream pending Forwarded: https://bugs.ghostscript.com/show_bug.cgi?id=702253 X-Debbugs-Cc: t...@security.debian.org
Hi, The following vulnerability was published for mupdf. It is already addressed in bullseye and sid. I have prepared a NMU RFS with the fix for buster at #983104. CVE-2020-16600[0]: | A Use After Free vulnerability exists in Artifex Software, Inc. MuPDF library 1.17.0-rc1 | and earlier when a valid page was followed by a page with invalid pixmap dimensions, | causing bander - a static - to point to previously freed memory instead of a newband_writer. [0] https://security-tracker.debian.org/tracker/CVE-2020-16600 [1] https://bugs.ghostscript.com/show_bug.cgi?id=702253
