CVE-2017-7885 Artifex jbig2dec 0.13 has a heap-based buffer over-read leading to denial of service (application crash) or disclosure of sensitive information from process memory, because of an integer overflow in t...
HighCVSS 7.1
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Artifex jbig2dec 0.13 has a heap-based buffer over-read leading to denial of service (application crash) or disclosure of sensitive information from process memory, because of an integer overflow in the jbig2_decode_symbol_dict function in jbig2_symbol_dict.c in libjbig2dec.a during operation on a crafted .jb2 file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/jbig2dec(Debian:12) | < 0.13-4.1 | 0.13-4.1 |
| debian/jbig2dec(Debian:13) | < 0.13-4.1 | 0.13-4.1 |
| debian/jbig2dec(Debian:14) | < 0.13-4.1 | 0.13-4.1 |
| artifex jbig2dec | = 0.13 | No fix listed |
References
- Debian Security Tracker CVE-2017-7885 vendor-advisory
- DSA-3855 vendor-advisory
- bugs.ghostscript.com issue-tracking
- GLSA-201708-10 vendor-advisory
- bugs.debian.org issue-tracking