CVE-2017-7975 Artifex jbig2dec 0.13, as used in Ghostscript, allows out-of-bounds writes because of an integer overflow in the jbig2_build_huffman_table function in jbig2_huffman.c during operations on a crafted JB...
HighCVSS 7.8
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Artifex jbig2dec 0.13, as used in Ghostscript, allows out-of-bounds writes because of an integer overflow in the jbig2_build_huffman_table function in jbig2_huffman.c during operations on a crafted JBIG2 file, leading to a denial of service (application crash) or possibly execution of arbitrary code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/jbig2dec(Debian:12) | < 0.13-4.1 | 0.13-4.1 |
| debian/jbig2dec(Debian:13) | < 0.13-4.1 | 0.13-4.1 |
| debian/jbig2dec(Debian:14) | < 0.13-4.1 | 0.13-4.1 |
| artifex jbig2dec | = 0.13 | No fix listed |
References
- Debian Security Tracker CVE-2017-7975 vendor-advisory
- DSA-3855 vendor-advisory
- bugs.ghostscript.com issue-tracking
- GLSA-201708-10 vendor-advisory
- bugs.debian.org issue-tracking