PT-2017-18040 · Artifex+1 · Jbig2Dec+1

Icepng · Published 2017-04-19 · Updated 2024-06-15 · CVE-2017-7976

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Artifex jbig2dec version 0.13

Description The issue is caused by an integer overflow in the jbig2 image compose function in jbig2 image.c when processing a crafted .jb2 file. This can lead to out-of-bounds writes and reads, resulting in a denial of service (application crash) or disclosure of sensitive information from process memory.

Recommendations For Artifex jbig2dec version 0.13, consider applying a patch or fix to address the integer overflow in the jbig2 image compose function to prevent out-of-bounds writes and reads. As a temporary workaround, restrict the processing of untrusted .jb2 files to minimize the risk of exploitation.

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2017-7976

DLA-942-1

DSA-3855-1

MGASA-2017-0206

OPENSUSE-SU-2024:11068-1

USN-3297-1

Affected Products

Ubuntu

Jbig2Dec

References · 47

• https://nvd.nist.gov/vuln/detail/CVE-2017-7976 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/XWQQMCDLDOZ535O3IKFQZE3VPCWC3HWH · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7976 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3855-1 · Vendor Advisory
• https://debian.org/security/2017/dsa-3817 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11068-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-7976 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3855-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0206 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7976 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7976 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7885 · Security Note
• https://advisories.mageia.org/MGASA-2017-0206.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7976 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9601 · Security Note