Security Update for jbig2dec Package
Summary
DLA-942-1: jbig2dec - security update. Affects jbig2dec versions < 0.13-4~deb7u2. Fixed in 0.13-4~deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jbig2dec package is a library for decoding JBIG2 image files. It is used by various applications, including Ghostscript. The package provides functionality for decompressing and rendering JBIG2 images. However, it has been found to contain multiple security vulnerabilities.
Vulnerability Detail
The jbig2dec package is affected by three vulnerabilities:
-
CVE-2017-7885: This vulnerability is caused by an integer overflow in the jbig2_decode_symbol_dict function. It can lead to a denial of service (application crash) or disclosure of sensitive information from process memory when processing a crafted .jb2 file.
-
CVE-2017-7975: An integer overflow in the jbig2_build_huffman_table function can cause out-of-bounds writes. This vulnerability, when triggered by a crafted JBIG2 file, can result in a denial of service (application crash) or potentially allow execution of arbitrary code.
-
CVE-2017-7976: The jbig2_image_compose function is susceptible to an integer overflow, leading to out-of-bounds writes and reads. Exploiting this vulnerability with a crafted .jb2 file can cause a denial of service (application crash) or disclosure of sensitive information from process memory.
How To Fix
Minimum fixed version
0.13-4~deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jbig2decTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The jbig2dec package has been found to contain multiple security vulnerabilities that can lead to denial of service, information disclosure, and potential code execution. It is crucial to update the package to version 0.13-4~deb7u2 or later to mitigate these risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for jbig2dec →
FAQ
These vulnerabilities can lead to a denial of service (application crash) or disclosure of sensitive information from process memory. In some cases, they may also allow execution of arbitrary code.
The vulnerabilities affect jbig2dec version 0.13. Prior versions may also be affected.
At the time of this advisory, there are no known public exploits for these vulnerabilities. However, it is always recommended to apply security updates promptly to mitigate the risk.
Yes, these vulnerabilities can be exploited remotely if an attacker can trick a user or system into opening a specially crafted JBIG2 file.
Yes, you can find more information about these vulnerabilities in the Debian LTS security advisories: CVE-2017-7885, CVE-2017-7975, and CVE-2017-7976.
Related vulnerabilities
Recent vulnerabilities recorded for jbig2dec.
