CVE-2017-17858

Heap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote attacker to potentially execute arbitrary code via a crafted PDF file, because xref subsection object numbers are unrestricted.

• CWE-119

• http://git.ghostscript.com/?p=mupdf.git%3Ba=commit%3Bh=55c3f68d638ac1263a386e0aaa004bb6e8bde731
• https://bugs.ghostscript.com/show_bug.cgi?id=698819Permissions Required
• https://github.com/mzet-/Security-Advisories/blob/master/mzet-adv-2017-01.mdExploit, Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201811-15
• http://git.ghostscript.com/?p=mupdf.git%3Ba=commit%3Bh=55c3f68d638ac1263a386e0aaa004bb6e8bde731
• https://bugs.ghostscript.com/show_bug.cgi?id=698819Permissions Required
• https://github.com/mzet-/Security-Advisories/blob/master/mzet-adv-2017-01.mdExploit, Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201811-15

Published

Jan 22, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-17852kernel/bpf/verifier.c in the Linux kernel through 4.14.8 all…7.8
• CVE-2017-17853kernel/bpf/verifier.c in the Linux kernel through 4.14.8 all…7.8
• CVE-2017-17854kernel/bpf/verifier.c in the Linux kernel through 4.14.8 all…7.8
• CVE-2017-17855kernel/bpf/verifier.c in the Linux kernel through 4.14.8 all…7.8
• CVE-2017-17856kernel/bpf/verifier.c in the Linux kernel through 4.14.8 all…7.8
• CVE-2017-17857The check_stack_boundary function in kernel/bpf/verifier.c i…7.8
• CVE-2017-17859Samsung Internet Browser 6.2.01.12 allows remote attackers t…
• CVE-2017-1786IBM WebSphere MQ 8.0 through 8.0.0.8 and 9.0 through 9.0.4 u…
• CVE-2017-17860In Samsung Gear products, Bluetooth link key is updated to t…
• CVE-2017-17862kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ign…
• CVE-2017-17863kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.…
• CVE-2017-17864kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mis…