Summary
It was discovered that libjxl did not perform proper bounds checking
when parsing Exif tags. An attacker could possibly use this issue to
cause libjxl to crash, resulting in a denial of service. (CVE-2023-0645)
It was discovered that libjxl did not perform proper bounds checking
when decoding patches. An attacker could possibly use this issue to
cause libjxl to enter an infinite loop, resulting in a denial of
service. (CVE-2023-35790)
It was discovered that libjxl did not perform proper bounds checking
when performing JPEG recompression. An attacker could possibly use this
issue to cause libjxl to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2024-11403)
It was discovered that libjxl incorrectly handled parsing certain image
files. An attacker could possibly use this issue to cause libjxl to
consume excessive amounts of memory, resulting in a denial of service.
(CVE-2024-11498)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | jpeg-xl | 0.7.0-10.2ubuntu6.1 |
Vulnerabilities 4
-
Medium 6.9
Out of Bounds Memory Read/Write in libjxl
There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not…
-
Medium 6.9
Resource exhaustion via Stack overflow in libjxl
There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will caus…
-
Medium 5.3
Out of Bounds read in libjxl
An out of bounds read exists in libjxl. An attacker using a specifically crafted file could cause an out of bounds read in the exif handler. We recommend upgrading to version 0.8.1 or past commit https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c182…
-
Unscored —
An issue was discovered in dec_patch_dictionary.cc in libjxl before 0.8.2. An integer underflow in patch decoding can l…