CVE-2017-7976

High

Published: 19/04/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Artifex jbig2dec version 0.13 allows out-of-bounds reads and writes due to an integer overflow in the jbig2_image_compose function in jbig2_image.c during operations on a crafted .jb2 file. This can lead to application crashes or disclosure of sensitive information from process memory.

Risk Assessment

The organization may experience application crashes, leading to service downtime, as well as the risk of sensitive data exposure.

Recommendation

It is recommended to update to the latest version of jbig2dec to mitigate this vulnerability and to monitor systems for unauthorized access to data.

Other vulnerabilities in Artifex jbig2dec 0.13

CVE-2017-7885High
Version 0.13 of the Artifex jbig2dec library has a heap-based buffer over-read vulnerability that can lead to application crashes or disclosure of sensitive information from process memory. The issue occurs in the jbig2_decode_symbol_dict function while processing a crafted .jb2 file.

Original NVD description (English source)

Artifex jbig2dec 0.13 allows out-of-bounds writes and reads because of an integer overflow in the jbig2_image_compose function in jbig2_image.c during operations on a crafted .jb2 file, leading to a denial of service (application crash) or disclosure of sensitive information from process memory.