CVE-2017-9216

What it actually does

NULL pointer dereference in jbig2_huffman_get during JBIG2 Huffman decoding causes segmentation fault when processing a malformed image stream.

Why it matters to the business

Applications that render or convert documents containing JBIG2 images can be forced offline by a single malicious file, interrupting document workflows and requiring restarts or restarts of dependent services.

How an attack unfolds

An attacker crafts a JBIG2 image that triggers the NULL dereference path in jbig2_huffman_get, then delivers the file through any channel that causes the vulnerable library to parse it (e.g., PDF upload, email attachment, or image conversion). The library crashes on first invalid Huffman table access.

How to fix it

Upgrade the jbig2dec component to a version that resolves the NULL dereference (0.14 or later) or replace the affected library entirely. Where fixed_versions indicate the component is absent, verify that no vulnerable jbig2dec binary is present in the runtime image.

How to confirm the fix worked

Run the jbig2dec utility or any consuming application against a known crashing test file and confirm absence of segmentation fault; additionally scan container images for the presence of libjbig2dec.so older than the patched release.

Typical attack path

1. Identify application entry points that accept PDF or JBIG2 image input
2. Generate or obtain a malformed JBIG2 stream that reaches jbig2_huffman_get with a NULL table pointer
3. Upload or transmit the crafted file to the target application
4. Observe process termination and service unavailability

How to detect it

Review application and container logs for segmentation fault entries referencing jbig2_huffman.c or jbig2dec immediately after receipt of a PDF or image upload; correlate with file upload timestamps in proxy or application access logs.

What your security team should do

• Confirm whether any deployed image still ships a vulnerable jbig2dec binary
• Block processing of untrusted PDF/JBIG2 content until libraries are updated
• Add the crash signature to application monitoring to detect attempted exploitation