Gentoo update for jbig2dec
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2017-7885 CVE-2017-7975 CVE-2017-7976 |
| CWE-ID | CWE-190 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Gentoo Linux Operating systems & Components / Operating system |
| Vendor | Gentoo |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Integer overflow
EUVDB-ID: #VU6702
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2017-7885
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information or cause DoS condition.
The weakness exists due to integer overflow in the jbig2_decode_symbol_dict function in jbig2_symbol_dict.c in libjbig2dec.a during operation on a crafted .jb2 file. A remote attacker can send a specially crafted .jb2 file, trigger heap-based buffer over-read and access arbitrary files from process memory or cause the application to crash.
Successful exploitation of the vulnerability may result in information disclosure or denial of service.
Update the affected packages.
media-libs/jbig2dec to version: 0.13-r4
Gentoo Linux: All versions
CPE2.3 External linkshttps://security.gentoo.org/glsa/201708-10
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Integer overflow
EUVDB-ID: #VU6703
Risk: High
CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2017-7975
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code.
The weakness exists due to integer overflow in the jbig2_build_huffman_table function in jbig2_huffman.c during operations on a crafted JBIG2 file. A remote attacker can send a specially crafted .jb2 file, trigger out-of-bounds writes and cause the application to crash or execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability may result in system compromise.
Update the affected packages.
media-libs/jbig2dec to version: 0.13-r4
Gentoo Linux: All versions
CPE2.3 External linkshttps://security.gentoo.org/glsa/201708-10
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Integer overflow
EUVDB-ID: #VU6704
Risk: Medium
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2017-7976
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information or cause DoS condition.
The weakness exists due to integer overflow in the jbig2_image_compose function in jbig2_image.c during operations on a crafted .jb2 file. A remote attacker can send a specially crafted .jb2 file, trigger out-of-bounds writes and access arbitrary files from process memory, cause the application to crash or possibly execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
Update the affected packages.
media-libs/jbig2dec to version: 0.13-r4
Gentoo Linux: All versions
CPE2.3 External linkshttps://security.gentoo.org/glsa/201708-10
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
