CVE-2017-9216: libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in th

This month

MEDIUM 6.5WATCHLISTDOWNGRADEDOWNGRADEMITIGATE

CVE-2017-9216 is a medium-severity flaw (CVSS 6.5) affecting jbig2dec, jbig2dec, debian linux. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c. For example, the jbig2dec utility will crash (segmentation fault) when parsing an invalid file.

Why this priority

Public exploit reference
On your watchlist

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	6.5 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	3.5% (top 11%)
CISA exploited list	No
Weakness	CWE-476
Published	2017-05-24
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: artifex · debian

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2017-05-24 05:29 UTCPublished CVE record published
2026-06-17 01:27 UTCUpdated Record last modified

artifex jbig2dec DOWNGRADE

Affected: 0.13

Fixed in: no fixed release known

Safe to downgrade to: a release before 0.13

1. Check installed version

apt-cache policy jbig2dec || rpm -q jbig2dec || jbig2dec --version

2. No fixed release: DOWNGRADE to a release before 0.13 (Debian / Ubuntu)

apt-cache madison jbig2dec sudo apt install jbig2dec=<VERSION_BEFORE_0.13> sudo apt-mark hold jbig2dec

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list jbig2dec sudo dnf downgrade jbig2dec-<VERSION_BEFORE_0.13> sudo dnf versionlock add jbig2dec

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

artifex jbig2dec DOWNGRADE

Affected: 0.13

Fixed in: no fixed release known

Safe to downgrade to: a release before 0.13

1. Check installed version

apt-cache policy jbig2dec || rpm -q jbig2dec || jbig2dec --version

2. No fixed release: DOWNGRADE to a release before 0.13 (Debian / Ubuntu)

apt-cache madison jbig2dec sudo apt install jbig2dec=<VERSION_BEFORE_0.13> sudo apt-mark hold jbig2dec

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list jbig2dec sudo dnf downgrade jbig2dec-<VERSION_BEFORE_0.13> sudo dnf versionlock add jbig2dec

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

debian debian linux MITIGATE

Affected: 9.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 9.0

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2017-9216?

jbig2dec: downgrade or apply the listed mitigation; jbig2dec: downgrade or apply the listed mitigation; debian linux: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2017-9216 being exploited?

CVE-2017-9216 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2017-9216 affect?

CVE-2017-9216 affects jbig2dec, jbig2dec, debian linux. Severity is medium (CVSS 6.5). libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c. For example, the jbig2dec utility will crash (segmentation fault) when parsing an

How urgent is CVE-2017-9216?

Priority 55/100. Public exploit reference; On your watchlist

Software pages

Debian vulnerabilities · Ghostscript vulnerabilities

Related CVEs

CVE-2023-46361 MEDIUM 6.5 DOWNGRADE Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jb
CVE-2020-12268 CRITICAL 9.8 UPGRADE MITIGATE jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow.
CVE-2017-7976 HIGH 7.1 DOWNGRADE Artifex jbig2dec 0.13 allows out-of-bounds writes and reads because of an integer overflow in the jbig2_image_
CVE-2017-7975 HIGH 7.8 DOWNGRADE Artifex jbig2dec 0.13, as used in Ghostscript, allows out-of-bounds writes because of an integer overflow in t
CVE-2017-7885 HIGH 7.1 DOWNGRADE Artifex jbig2dec 0.13 has a heap-based buffer over-read leading to denial of service (application crash) or di

References

← Back to latest CVEs