CVE-2017-11590

High

Published: 24/07/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

There is a NULL pointer dereference in the caseless_hash function in gxps-archive.c in libgxps 0.2.5. A crafted input will lead to a remote denial of service attack.

Risk Assessment

An attacker can exploit this vulnerability to remotely disrupt service, potentially causing downtime in system operations.

Recommendation

It is recommended to update the libgxps library to the latest version to mitigate this vulnerability.

Other vulnerabilities in libgxps 0.2.5

CVE-2026-111132Medium
GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows reading past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. An attacker can supply a point count not divisible by three or two in a crafted XPS document to crash consumers like Evince and render adjacent heap memory into output.

Original NVD description (English source)

There is a NULL pointer dereference in the caseless_hash function in gxps-archive.c in libgxps 0.2.5. A crafted input will lead to a remote denial of service attack.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS