CVE-2017-9216: artifex jbig2dec NULL Pointer Dereference
Vulnerability summary
CVE-2017-9216 is a medium (CVSS 6.5) NULL Pointer Dereference vulnerability in artifex jbig2dec. EPSS estimates a 3.45% chance of exploitation in the next 30 days, higher than 89% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 4Timeline
- 24-05-2017PublishedVulnerability first disclosed.
- 11-09-2024Last modifiedVulnerability information updated.
Description
libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c. For example, the jbig2dec utility will crash (segmentation fault) when parsing an invalid file.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.45%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.45% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (bugs.ghostscript.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- jbig2dec< 0.13-5
- debian_linuxEOL9.0
Mageia2 products
- jbig2dec< 0.14-1.mga5
- jbig2dec< 0.14-1.mga6
Artifex1 product
- jbig2dec0.13
Ubuntu1 product
- jbig2decAll versions (No fix recorded) | < 0.12+20150918-1ubuntu0.1+esm2
4 vendors · 6 products
