CVE-2017-9216 libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c. For example, the jbig2dec utility will cr...
MediumCVSS 6.5
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c. For example, the jbig2dec utility will crash (segmentation fault) when parsing an invalid file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/jbig2dec(Debian:12) | < 0.13-5 | 0.13-5 |
| debian/jbig2dec(Debian:13) | < 0.13-5 | 0.13-5 |
| debian/jbig2dec(Debian:14) | < 0.13-5 | 0.13-5 |
| artifex jbig2dec | = 0.13 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- Debian Security Tracker CVE-2017-9216 vendor-advisory
- 98680 third-party-advisory vdb-entry
- bugs.ghostscript.com exploit patch vendor-advisory
- git.ghostscript.com
- [debian-lts-announce] 20211028 [SECURITY] [DLA 2796-1] jbig2dec security update mailing-list third-party-advisory
- bugs.debian.org issue-tracking