[Secure-testing-team] Bug#860788: jbig2dec: CVE-2017-7975: Out-of-bound memory write vulnerability due to integer overflow in function jbig2_build_huffman_table

[Salvatore Bonaccorso]

Source: jbig2dec
Version: 0.13-4
Severity: important
Tags: upstream security
Forwarded: https://bugs.ghostscript.com/show_bug.cgi?id=697693
Control: found -1 0.13-4~deb8u1

Hi,

the following vulnerability was published for jbig2dec.

CVE-2017-7975[0]:
| Artifex jbig2dec 0.13, as used in Ghostscript, allows out-of-bounds
| writes because of an integer overflow in the jbig2_build_huffman_table
| function in jbig2_huffman.c during operations on a crafted JBIG2 file,
| leading to a denial of service (application crash) or possibly
| execution of arbitrary code.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-7975
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7975
[1] https://bugs.ghostscript.com/show_bug.cgi?id=697693

Regards,
Salvatore