Please read this before reporting a bug:
http://wiki.archlinux.org/index.php/Reporting_Bug_Guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!

Tasklist

Task Type Bug Report Category Security Status Closed Assigned To Christian Hesse (eworm) Johannes Löthberg (demize) Levente Polyak (anthraxx) Eli Schwartz (eschwartz) Architecture All Severity High Priority Normal Reported Version Due in Version Undecided Due Date Undecided Percent Complete Votes 0 Private No

Details Summary ======= The package mupdf is vulnerable to multiple issues including arbitrary code execution and denial of service via CVE-2018-6544, CVE-2018-6192, CVE-2018-6187, CVE-2018-5686 and CVE-2018-1000051. Guidance ======== No upstream releases yet. References ========== https://security.archlinux.org/AVG-609 https://bugs.ghostscript.com/show_bug.cgi?id=698965 https://bugs.ghostscript.com/show_bug.cgi?id=698830 http://git.ghostscript.com/?p=mupdf.git;h=b03def134988da8c800adac1a38a41a1f09a1d89 http://git.ghostscript.com/?p=mupdf.git;h=26527eef77b3e51c2258c8e40845bfbc015e405d https://bugs.ghostscript.com/show_bug.cgi?id=698916 http://git.ghostscript.com/?p=mupdf.git;h=5e411a99604ff6be5db9e273ee84737204113299 https://bugs.ghostscript.com/show_bug.cgi?id=698908 http://git.ghostscript.com/?p=mupdf.git;h=3e30fbb7bf5efd88df431e366492356e7eb969ec http://git.ghostscript.com/?p=mupdf.git;h=b70eb93f6936c03d8af52040bbca4d4a7db39079 https://bugs.ghostscript.com/show_bug.cgi?id=698860 https://bugs.ghostscript.com/show_bug.cgi?id=698825 https://bugs.ghostscript.com/show_bug.cgi?id=698873 http://www.ghostscript.com/cgi-bin/findgit.cgi?321ba1de287016b0036bf4a56ce774ad11763384

Closed by  Eli Schwartz (eschwartz)
Sunday, 13 May 2018, 13:01 GMT
Reason for closing:  Fixed
Additional comments about closing:  mupdf 1.13.0-1
llpp 27-2
zathura-pdf-mupdf 0.3.3-3

Comment by Eli Schwartz (eschwartz) - Thursday, 10 May 2018, 16:06 GMT

Comment by Eli Schwartz (eschwartz) - Thursday, 10 May 2018, 16:14 GMT