CVE-2017-7976 Artifex jbig2dec 0.13 allows out-of-bounds writes and reads because of an integer overflow in the jbig2_image_compose function in jbig2_image.c during operations on a crafted .jb2 file, leading to a d...
HighCVSS 7.1
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Artifex jbig2dec 0.13 allows out-of-bounds writes and reads because of an integer overflow in the jbig2_image_compose function in jbig2_image.c during operations on a crafted .jb2 file, leading to a denial of service (application crash) or disclosure of sensitive information from process memory.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/jbig2dec(Debian:12) | < 0.13-4.1 | 0.13-4.1 |
| debian/jbig2dec(Debian:13) | < 0.13-4.1 | 0.13-4.1 |
| debian/jbig2dec(Debian:14) | < 0.13-4.1 | 0.13-4.1 |
| artifex jbig2dec | = 0.13 | No fix listed |
References
- Debian Security Tracker CVE-2017-7976 vendor-advisory
- DSA-3855 vendor-advisory
- bugs.ghostscript.com issue-tracking
- GLSA-201708-10 vendor-advisory
- bugs.debian.org issue-tracking