ArchLinux: 201711-28: jbig2dec: denial of service
Summary
libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c. For example, the jbig2dec utility will crash (segmentation fault) when parsing an invalid file.
Resolution
Upgrade to 0.14-1.
# pacman -Syu "jbig2dec>=0.14-1"
The problem has been fixed upstream in version 0.14.
References
https://bugs.archlinux.org/task/56405 https://bugs.ghostscript.com/show_bug.cgi?id=697934 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=3ebffb1d96ba0cacec23016eccb4047dab365853 https://security.archlinux.org/CVE-2017-9216
![Dist Arch](/images/distros/dist-arch.png)
Workaround
None.