CVE-2017-7885

High

Published: 17/04/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Version 0.13 of the Artifex jbig2dec library has a heap-based buffer over-read vulnerability that can lead to application crashes or disclosure of sensitive information from process memory. The issue occurs in the jbig2_decode_symbol_dict function while processing a crafted .jb2 file.

Risk Assessment

Organizations may experience application downtime and the risk of sensitive data disclosure, which can lead to serious information security consequences.

Recommendation

It is recommended to update the jbig2dec library to the latest version to mitigate this vulnerability and to monitor systems for unauthorized access to data.

Other vulnerabilities in Artifex jbig2dec 0.13

CVE-2017-7976High
Artifex jbig2dec version 0.13 allows out-of-bounds reads and writes due to an integer overflow in the jbig2_image_compose function in jbig2_image.c during operations on a crafted .jb2 file. This can lead to application crashes or disclosure of sensitive information from process memory.

Original NVD description (English source)

Artifex jbig2dec 0.13 has a heap-based buffer over-read leading to denial of service (application crash) or disclosure of sensitive information from process memory, because of an integer overflow in the jbig2_decode_symbol_dict function in jbig2_symbol_dict.c in libjbig2dec.a during operation on a crafted .jb2 file.