CVE-2014-2013

Name of the Vulnerable Software and Affected Versions MuPDF versions 1.3 and earlier

Description The issue is related to a stack-based buffer overflow in the xps parse color function, which can be exploited by remote attackers to execute arbitrary code. This can be achieved by providing a large number of entries in the ContextColor value of the Fill attribute in a Path element. The vulnerability may lead to disruption of confidentiality, integrity, and availability of protected information and can be exploited remotely.

Recommendations For MuPDF versions 1.3 and earlier, as a temporary workaround, consider disabling the xps parse color function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.