CVE-2017-9216: Null Pointer Dereference
libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2huffmanget function in jbig2huffman.c. For example, the jbig2dec utility will crash (segmentation fault) when parsing an invalid file.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9216?
CVE-2017-9216 has a medium severity level due to potential denial of service caused by a NULL pointer dereference.
How do I fix CVE-2017-9216?
To fix CVE-2017-9216, update to the patched versions of libjbig2dec, specifically version 0.13 or later.
What software is affected by CVE-2017-9216?
CVE-2017-9216 affects Artifex jbig2dec 0.13, which is used in applications like MuPDF and Ghostscript.
Can CVE-2017-9216 lead to application crashes?
Yes, CVE-2017-9216 can cause crashes (segmentation faults) when the jbig2dec utility attempts to parse an invalid file.
Is CVE-2017-9216 exploitable remotely?
CVE-2017-9216 is considered potentially exploitable if an attacker can provide an invalid JBIG2 file to the jbig2dec utility.