libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c. For example, the jbig2dec utility will crash (segmentation fault) when parsing an invalid file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 24, 2017 |
| Debian | — | Upgrade jbig2dec | Nov 29, 2021 | May 24, 2017 |
| Ghostscript | — | Upgrade to Ghostscript version 9.22 | Oct 11, 2018 | May 24, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ghostscriptUpgrade ghostscript-cups | Sep 16, 2021 | May 24, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ghostscriptUpgrade ghostscript-cups | Dec 18, 2019 | May 24, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ghostscript-cupsUpgrade ghostscript | Dec 11, 2019 | May 24, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 23, 2017 |
| Suse | — | Upgrade libgimpprintUpgrade ghostscript-x11Upgrade ghostscript-fonts-otherUpgrade ghostscript-ijs-develUpgrade ghostscript-omniUpgrade ghostscriptUpgrade libgimpprint-develUpgrade ghostscript-fonts-stdUpgrade ghostscript-fonts-rusUpgrade ghostscript-libraryUpgrade ghostscript-devel | Feb 14, 2018 | May 24, 2017 |
| Ubuntu | — | Upgrade jbig2dec (Ubuntu Pro)Upgrade libjbig2dec0 (Ubuntu Pro) | May 6, 2022 | May 24, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub