CVE-2020-19609

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2020-19609
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-19609.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-19609
Downstream
Related
Published
2021-07-21T15:15:12Z
Modified
2025-10-15T12:07:21.123487Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Artifex MuPDF before 1.18.0 has a heap based buffer over-write in tiffexpandcolormap() function when parsing TIFF files allowing attackers to cause a denial of service.

References

Affected packages

Git / github.com/artifexsoftware/mupdf

Affected ranges

Type
GIT
Repo
https://github.com/artifexsoftware/mupdf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ea5799e01730c4aa15cddd1023700e4f7b78cc27

Affected versions

0.*

0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9

1.*

1.0
1.0rc1
1.1
1.1-forms-tech-preview
1.10
1.10-rc1
1.10-rc2
1.11
1.11-rc1
1.11.1
1.12.0
1.13.0
1.13.0-rc1
1.14.0
1.14.0-rc1
1.15.0
1.15.0-rc1
1.16.0
1.16.0-rc1
1.16.0-rc2
1.16.1
1.16.1-epub-prerelease
1.17.0
1.17.0-rc1
1.18.0-rc1
1.2
1.3
1.3rc1
1.4
1.4-ios
1.5
1.5-ios
1.5-ios-appstore
1.5-ios-rc6
1.5-ios-rc7
1.5-ios-rc8
1.6
1.6-appstore
1.6-ios-rc1
1.6-ios-rc2
1.7
1.7-rc1
1.7a
1.8
1.9
1.9-rc1
1.9-rc2
1.9a

Other

android-release-60

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "target": {
            "file": "source/tools/murun.c"
        },
        "source": "https://github.com/artifexsoftware/mupdf/commit/ea5799e01730c4aa15cddd1023700e4f7b78cc27",
        "deprecated": false,
        "id": "CVE-2020-19609-91bd22d4",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "76920546631759322246527467490251199875",
                "340040321338536262114100541643141255870",
                "116442093724906783824796458210151561654",
                "39735944821352736364414258139594747771",
                "201723191520396315939464895643274110115",
                "20129206999309322410363543612250604961",
                "253549865349229191539173383921154422334",
                "69739083799557896998941262877448309888",
                "96840014772434106414225453686075656896",
                "269940169438491882205853047335703195872",
                "193123336443576537584243481354558573900",
                "470424901104694111857759229088345522",
                "148528187658349439914426295209030690800",
                "36862906143268150745729279185893731936",
                "14075825109739105745149694780895933509",
                "137502807814932668203387647412756923614",
                "97603555291672204948109317861153438342",
                "326261060561488912049801467062038365194",
                "255897402392510710039415928318102135017",
                "310965173133449292282000847890337953773"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "function": "murun_main",
            "file": "source/tools/murun.c"
        },
        "source": "https://github.com/artifexsoftware/mupdf/commit/ea5799e01730c4aa15cddd1023700e4f7b78cc27",
        "deprecated": false,
        "id": "CVE-2020-19609-e21e7b3e",
        "signature_version": "v1",
        "digest": {
            "length": 23845.0,
            "function_hash": "251675964121664698738070537556026348583"
        }
    }
]