CVE-2017-9776 — poppler: Integer overflow in JBIG2Stream.cc

Back Back to CVE browser

HIGH

poppler: Integer overflow in JBIG2Stream.cc

Published Jun 22, 2017

7.8

HIGH

CVSS 3.0

EPSS 2.00%

Description

Integer overflow leading to Heap buffer overflow in JBIG2Stream.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.

Affected products

Red Hat Enterprise Linux 6

poppler-0:0.12.4-12.el6_9

Fixed · RHSA-2017:2550
Red Hat Enterprise Linux 7

poppler-0:0.26.5-17.el7_4

Fixed · RHSA-2017:2551
Red Hat Enterprise Linux 5

poppler

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	poppler-0:0.12.4-12.el6_9	Fixed	RHSA-2017:2550
Red Hat Enterprise Linux 7	poppler-0:0.26.5-17.el7_4	Fixed	RHSA-2017:2551
Red Hat Enterprise Linux 5	poppler	Will not fix	n/a

Remediation

No remediation recorded yet.

Metrics

2.00% 0.01999

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01999

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (12 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.00% (0.01999)	79.99th	v5 (v2026.06.15)
Jun 15, 2026	2.00% (0.01999)	78.08th	v5 (v2026.06.15)
Aug 21, 2025	1.25% (0.01248)	78.49th	v4 (v2025.03.14)
Mar 17, 2025	0.15% (0.00152)	33.39th	v4 (v2025.03.14)
Dec 12, 2024	0.49% (0.00487)	76.82th	v3 (v2023.03.01)
Feb 8, 2024	0.49% (0.00487)	75.31th	v3 (v2023.03.01)
Sep 3, 2023	0.49% (0.00487)	72.98th	v3 (v2023.03.01)
Mar 7, 2023	0.34% (0.00343)	66.94th	v3 (v2023.03.01)
Mar 6, 2023	1.21% (0.01213)	66.61th	v2 (v2022.01.01)
Feb 4, 2022	1.21% (0.01213)	40.54th	v2 (v2022.01.01)
Feb 3, 2022	1.94% (0.01943)	48.45th	v5 (v2026.06.15)
Apr 14, 2021	1.94% (0.01943)	0.00th	v1

Weaknesses (1)

CWE-190

Integer Overflow

References (9)

http://www.securityfocus.com/bid/99240
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:2550
vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/errata/RHSA-2017:2551
vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2017-9776
Vendor Advisory
https://bugs.freedesktop.org/show_bug.cgi?id=101541
x_refsource_CONFIRMIssue TrackingPatchVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1466443
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-9776
https://www.cve.org/CVERecord?id=CVE-2017-9776
https://www.debian.org/security/2018/dsa-4079
vendor-advisoryx_refsource_DEBIANThird Party Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/99240		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:2550		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/errata/RHSA-2017:2551		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2017-9776		Vendor Advisory
https://bugs.freedesktop.org/show_bug.cgi?id=101541		x_refsource_CONFIRMIssue TrackingPatchVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1466443		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-9776
https://www.cve.org/CVERecord?id=CVE-2017-9776
https://www.debian.org/security/2018/dsa-4079		vendor-advisoryx_refsource_DEBIANThird Party Advisory