FERRAMENTAS LINUX: Critical MuPDF Vulnerabilities: Update Ubuntu Now to Fix Denial-of-Service Risks

Urgent Ubuntu security update: Patch critical MuPDF denial-of-service vulnerabilities (CVE-2023-51103, CVE-2024-46657, CVE-2025-46206) in Ubuntu 18.04-25.04 LTS. Learn the fixed versions and update steps.

A recent security advisory from Ubuntu, USN-7888-1, patches multiple critical vulnerabilities in MuPDF, a lightweight, open-source PDF, XPS, and E-book viewer.

These flaws could allow an attacker to crash the application, leading to a denial of service (DoS) for the user. If you use MuPDF on any Ubuntu LTS release from 18.04 to 25.04, your system could be at risk. This guide provides a detailed breakdown of the security issues and clear, step-by-step instructions to secure your system.

The vulnerabilities, tracked through several CVEs, include division-by-zero errors, NULL pointer dereferences, and infinite recursion bugs discovered in the PDF parsing engine.

An attacker could exploit these flaws by crafting a malicious PDF file; when opened in MuPDF, the application could freeze, crash, or become unresponsive.

For system administrators and developers who rely on MuPDF for document processing, these vulnerabilities represent a significant stability threat. The following sections will detail the specific vulnerabilities and provide the exact package versions you need to install.

Vulnerability Details and Associated CVEs

The fixed vulnerabilities in MuPDF cover a range of serious programming errors that can lead to application instability and crashes. Understanding the nature of each flaw highlights the importance of applying this update promptly.

The resolved security issues include :

CVE-2023-51103, CVE-2023-51104, CVE-2023-51105, CVE-2023-51106: A set of division-by-zero errors discovered in the software. These occur when a process attempts to divide a number by zero, an invalid operation that typically causes the program to terminate abruptly.

CVE-2024-46657: An issue where MuPDF incorrectly handled memory under certain circumstances, leading to a NULL pointer dereference. Dereferencing a pointer that does not point to a valid memory address will almost always cause a segmentation fault and crash the application .

CVE-2025-46206: A flaw that allowed MuPDF to enter an infinite recursion while parsing specially crafted PDF files. This consumes all available CPU resources in a loop, making the application unresponsive and causing a denial of service .

Patched Package Versions for Ubuntu

The Ubuntu security team has released updated MuPDF packages for all supported Long-Term Support (LTS) releases and the current interim release. To fix the vulnerabilities, you must update to the following specific package versions :

Ubuntu Release	Package Version
Ubuntu 25.04	`mupdf 1.25.1+ds1-5ubuntu0.1` `mupdf-tools 1.25.1+ds1-5ubuntu0.1`
Ubuntu 24.04 LTS	`mupdf 1.23.10+ds1-1ubuntu0.1~esm1` (Available with Ubuntu Pro)
Ubuntu 22.04 LTS	`mupdf 1.19.0+ds1-2ubuntu0.1~esm1` (Available with Ubuntu Pro)
Ubuntu 20.04 LTS	`mupdf 1.16.1+ds1-1ubuntu1+esm2` (Available with Ubuntu Pro)
Ubuntu 18.04 LTS	`mupdf 1.12.0+ds1-1ubuntu0.1~esm2` (Available with Ubuntu Pro)

For LTS releases, the patches are available through the Ubuntu Pro infrastructure, which provides expanded security maintenance for a wider range of packages.

Step-by-Step System Update Instructions

Applying the security fix is a standard procedure for Ubuntu systems. You can complete the update using the command line in a terminal window.

Open a terminal window (Ctrl+Alt+T).
Update your local package index by running the command:
bash
```
sudo apt update
```
This command refreshes the list of available packages and their versions.
Upgrade the MuPDF packages with the command:
bash
```
sudo apt upgrade mupdf mupdf-tools
```
If you are prompted, confirm the upgrade by typing 'Y' and pressing Enter.
Reboot your system (if necessary). While a simple application update may not require a reboot, it is a good practice to restart your system if you were using MuPDF at the time of the update to ensure all processes are cleanly restarted.

In general, a standard system update will make all the necessary changes to mitigate these specific denial-of-service risks .

Proactive Linux Security and Patch Management

Why is promptly applying a patch for a document viewer so critical? In the realm of Linux security, every application is a potential entry point.

A flaw in a seemingly innocuous program like a PDF reader can be the first step in a larger attack chain, disrupting workflows and compromising system integrity.

This MuPDF update is a prime example of the continuous maintenance required to keep Linux systems secure.

Staying vigilant with security updates is a core tenet of system administration. Canonical's Security Notice team consistently monitors and patches vulnerabilities across the Ubuntu ecosystem. To maintain a strong security posture, administrators should:

Regularly check for updates using apt update and apt upgrade.

Subscribe to security mailing lists like the Ubuntu Security Notices to receive immediate alerts .

Understand the scope of vulnerabilities by reading the associated CVE details.

For older LTS systems, consider enrolling in Ubuntu Pro, which provides a decade of security patching for both Main and Universe repositories, ensuring even legacy systems remain protected against newly discovered threats .

Frequently Asked Questions (FAQ)

Q1: What is MuPDF and why is it on my system?

A: MuPDF is a lightweight, high-performance open-source software framework for viewing and converting PDF, XPS, and E-book documents. It may be installed as a standalone viewer or as a dependency for other applications that handle document rendering.

Q2: Can these vulnerabilities lead to my system being hacked?

A: The CVEs listed in USN-7888-1 are classified as Denial-of-Service (DoS) vulnerabilities. While they are not currently rated as allowing remote code execution (RCE)—which would let an attacker run their own code on your machine—they can be exploited to crash the application, leading to data loss and disrupted productivity.

Q3: I'm using Ubuntu 18.04 LTS, which is past its standard End-of-Life. Can I still get this update?

A: Yes, the update for Ubuntu 18.04 LTS is available, but it requires an Ubuntu Pro subscription. Ubuntu Pro provides expanded security maintenance for critical packages on LTS releases for up to ten years .

Q4: How can I verify my current MuPDF version?

A: You can check the installed version by running mupdf --version in a terminal. Compare the output with the patched versions listed above to confirm your system is secure.