VULNERABILITY INTELLIGENCE

CVE-2017-2575

CVSS score6.5 MEDIUM

EPSS probability1.46%

CISA KEVNot currently listed

Published2018-08-22

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Description

A vulnerability was found while fuzzing libbpg 0.9.7. It is a NULL pointer dereference issue due to missing check of the return value of function malloc in the BPG encoder. This vulnerability appeared while converting a malicious JPEG file to BPG.

Weakness classification

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-476: NULL Pointer Dereference

Primary references

secalert@redhat.com — Mailing List, Third Party Advisory
secalert@redhat.com — Third Party Advisory, VDB Entry
nvd@nist.gov — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry