{"id":"CVE-2023-46361","aliases":["DEBIAN-CVE-2023-46361","EUVD-2023-50581","GHSA-jm56-5fwr-8p7q","MGASA-2026-0344","OESA-2024-2110","OESA-2024-2111","OESA-2024-2112","OESA-2024-2113","ROOT-OS-ALPINE-319-CVE-2023-46361","ROOT-OS-ALPINE-320-CVE-2023-46361","ROOT-OS-DEBIAN-12-CVE-2023-46361","UBUNTU-CVE-2023-46361","USN-8582-1","openSUSE-SU-2024:13445-1"],"status":"published","title":"Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at...","description":"Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00882,"percentile":0.596,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2023-10-31T00:00:00Z","modified":"2026-10-28T02:30:50Z","fixes":[{"ecosystem":"openEuler:24.03-LTS","package":"jbig2dec","fixed_in":["0.20-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"jbig2dec","fixed_in":["0.19-5.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"jbig2dec","fixed_in":["0.19-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"jbig2dec","fixed_in":["0.19-5.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.19","package":"jbig2dec","fixed_in":["0.20-r00071","0.20-r00075","0.20-r00072","0.20-r00073","0.20-r00074"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.19","package":"rootio-jbig2dec","fixed_in":["0.20-r00071","0.20-r00075","0.20-r00072","0.20-r00073","0.20-r00074"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"jbig2dec","fixed_in":["0.20-r00071","0.20-r00074","0.20-r00072","0.20-r00073","0.20-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-jbig2dec","fixed_in":["0.20-r00071","0.20-r00074","0.20-r00072","0.20-r00073","0.20-r00075"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"jbig2dec","fixed_in":["0.19-3+deb12u1.aikido.4"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-jbig2dec","fixed_in":["0.19-3+deb12u1.aikido.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"jbig2dec","fixed_in":["0.19-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"jbig2dec","fixed_in":["0.20-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"jbig2dec","fixed_in":["0.20-1ubuntu0.26.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19-3","0.19-3+deb12u1","0.20-1"]},{"source":"osv","ecosystem":"Debian:13","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20-1","0.20-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20-2.1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19-4.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19-5.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19-5.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.19","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20-r00071"},{"fixed":"0.20-r00075"},{"fixed":"0.20-r00072"},{"fixed":"0.20-r00073"},{"fixed":"0.20-r00074"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.19","package":"rootio-jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20-r00071"},{"fixed":"0.20-r00075"},{"fixed":"0.20-r00072"},{"fixed":"0.20-r00073"},{"fixed":"0.20-r00074"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20-r00071"},{"fixed":"0.20-r00074"},{"fixed":"0.20-r00072"},{"fixed":"0.20-r00073"},{"fixed":"0.20-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20-r00071"},{"fixed":"0.20-r00074"},{"fixed":"0.20-r00072"},{"fixed":"0.20-r00073"},{"fixed":"0.20-r00075"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19-3+deb12u1.aikido.4"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19-3+deb12u1.aikido.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19-3ubuntu0.1"}]}],"versions":["0.19-3","0.19-3build1","0.19-3build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20-1build3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19-3ubuntu0.1"}]}],"versions":["0.19-3","0.19-3build1","0.19-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20-1ubuntu0.24.04.1"}]}],"versions":["0.19-3build2","0.20-1","0.20-1build2","0.20-1build3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jbig2dec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20-1ubuntu0.26.04.1"}]}],"versions":["0.20-1build3","0.20-1build4"]}],"products":[{"vendor":"artifex","product":"jbig2dec"}],"references":[{"url":"https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/jbig2dec-SEGV/jbig2dec-SEGV.md","tags":["x_transferred","Exploit","Product","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46361","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jm56-5fwr-8p7q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46361.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-46361","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0344.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35994","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8582-1","tags":["advisory"]},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=707308","tags":["report"]},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=705041","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2110","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2111","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2112","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2113","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-46361","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-38076","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46361","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-46361","description":"Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.","status":"published","published":"2023-10-31T00:00:00Z","modified":"2024-09-05T19:06:13.257Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-50581","description":"Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.","status":"published","published":"2023-10-31T00:00:00Z","modified":"2024-09-05T19:06:13Z","updated_at":"2026-11-03T00:56:02.678796Z"}],"ghsa":[{"id":"GHSA-jm56-5fwr-8p7q","title":"Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at...","description":"Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.","status":"published","published":"2023-10-31T06:30:23Z","modified":"2024-09-05T21:31:32Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:58:10.812405Z"}],"nvd":[{"id":"CVE-2023-46361","description":"Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.","status":"published","published":"2023-10-31T06:15:08.9Z","modified":"2026-06-17T06:30:44.067Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:08:41.047232Z"}],"osv":[{"id":"DEBIAN-CVE-2023-46361","description":"Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.","status":"published","published":"2023-10-31T06:15:08.9Z","modified":"2026-10-26T18:03:07.337782827Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"OESA-2024-2110","title":"jbig2dec security update","description":"jbig2dec is a decoder implementation of the JBIG2 image compression format.\r\n\r\nSecurity Fix(es):\r\n\r\nArtifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.(CVE-2023-46361)","status":"published","published":"2024-09-06T11:07:35Z","modified":"2026-08-18T01:17:57.522528838Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2111","title":"jbig2dec security update","description":"jbig2dec is a decoder implementation of the JBIG2 image compression format.\r\n\r\nSecurity Fix(es):\r\n\r\nArtifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.(CVE-2023-46361)","status":"published","published":"2024-09-06T11:07:35Z","modified":"2026-08-18T01:18:36.902270169Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2112","title":"jbig2dec security update","description":"jbig2dec is a decoder implementation of the JBIG2 image compression format.\r\n\r\nSecurity Fix(es):\r\n\r\nArtifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.(CVE-2023-46361)","status":"published","published":"2024-09-06T11:07:35Z","modified":"2026-08-18T01:18:28.936854511Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2113","title":"jbig2dec security update","description":"jbig2dec is a decoder implementation of the JBIG2 image compression format.\r\n\r\nSecurity Fix(es):\r\n\r\nArtifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.(CVE-2023-46361)","status":"published","published":"2024-09-06T11:07:35Z","modified":"2026-08-18T01:18:36.727854287Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2023-46361","description":"Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.","status":"published","published":"2023-10-31T06:15:00Z","modified":"2026-07-22T03:30:13.519501927Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"CVE-2023-46361","description":"Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.","status":"published","published":"2023-10-31T00:00:00Z","modified":"2026-10-28T02:30:50.010038584Z","updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"MGASA-2026-0344","title":"Updated jbig2dec packages fix security vulnerabilities","description":"Artifex Software jbig2dec v0.20 was discovered to contain a SEGV\nvulnerability via jbig2_error at /jbig2dec/jbig2.c. (CVE-2023-46361)\nAn integer overflow in the jbig2_arith_iaid_ctx_new() function of\nArtifex commit cc37d0 allows attackers to cause a Denial of Service\n(DoS) via a crafted input. (CVE-2026-38076)\n","status":"published","published":"2026-08-31T16:22:02Z","modified":"2026-08-31T16:30:04.403347236Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2024:13445-1","title":"jbig2dec-0.20-2.1 on GA media","description":"These are all security issues fixed in the jbig2dec-0.20-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:17:58.331735Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"ROOT-OS-ALPINE-319-CVE-2023-46361","title":"CVE-2023-46361 in jbig2dec - Patched by Root","description":"Root has patched CVE-2023-46361 in the jbig2dec package for Root:Alpine:3.19. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:31:20Z","modified":"2026-09-29T10:16:08.103567928Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2023-46361","title":"CVE-2023-46361 in jbig2dec - Patched by Root","description":"Root has patched CVE-2023-46361 in the jbig2dec package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:55:57Z","modified":"2026-09-29T10:15:06.42743072Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2023-46361","title":"CVE-2023-46361 in jbig2dec - Patched by Root","description":"Root has patched CVE-2023-46361 in the jbig2dec package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-09T07:17:55Z","modified":"2026-10-09T08:16:18.930914385Z","updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"USN-8582-1","title":"jbig2dec vulnerabilities","description":"Zeng Yunxiang and Song Jiaxuan discovered that jbig2dec had an\nout-of-bounds read vulnerability in its command-line tool. An attacker\ncould possibly use this issue to cause jbig2dec to crash, resulting in a\ndenial of service. This issue only affected Ubuntu 22.04 LTS.\n(CVE-2023-46361)\n\nIt was discovered that jbig2dec had an integer overflow in the\njbig2_arith_iaid_ctx_new() function. An attacker could possibly use this\nissue to cause a denial of service. (CVE-2026-38076)","status":"published","published":"2026-07-21T17:41:35Z","modified":"2026-07-22T03:44:37.691036414Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}