CVE-2017-2575

A vulnerability was found while fuzzing libbpg 0.9.7. It is a NULL pointer dereference issue due to missing check of the return value of function malloc in the BPG encoder. This vulnerability appeared while converting a malicious JPEG file to BPG.

Score

CVSS 3.0 6.5 Medium

Status

Modified - secalert@redhat.com

Published

2018-08-22

Last modified

2024-09-17

Weaknesses

CWE-119, CWE-476

Affected products

• Libbpg (Fabrice Bellard)
• Libbpg (Libbpg Project)

References

• http://seclists.org/oss-sec/2017/q2/100
• http://www.securityfocus.com/bid/97963
• https://exchange.xforce.ibmcloud.com/vulnerabilities/148857