Unsound DecompressScanlines::read_scanlines in mozjpeg
Summary
GHSA-v8gq-5grq-9728: mozjpeg DecompressScanlines::read_scanlines is Unsound. Affects mozjpeg versions < 0.8.19. Fixed in 0.8.19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mozjpeg is an open-source crate available on crates.io that provides a Rust interface for working with the MozJPEG library. MozJPEG is a JPEG encoder that aims to improve the compression efficiency of JPEG images. It is widely used in various applications and libraries for image processing and compression. However, versions of the mozjpeg crate prior to 0.8.19 are affected by a vulnerability that allows the creation of instances of any type from bytes without proper constraints. This can lead to safety violations and potential memory corruption.
Vulnerability Detail
The vulnerability in mozjpeg arises from the ability to create instances of any type from bytes without proper constraints. This means that it is possible to construct pointers to invalid or arbitrary memory addresses, or violate safety and validity invariants required for the construction of certain types. This can result in memory corruption, crashes, or even potential code execution vulnerabilities. The issue is similar to the vulnerability identified in the rgb crate, which mozjpeg depends on. The vulnerability was addressed in version 0.8.19 of mozjpeg by using safer types and updating the rgb dependency.
How To Fix
Minimum fixed version
0.8.19
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the mozjpeg crate to the fixed version as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in mozjpeg can lead to memory corruption and potential code execution vulnerabilities. It is crucial to update the mozjpeg crate to version 0.8.19 or later to mitigate the risk. Additionally, it is advisable to review the project code for any potential unsafe usage and ensure proper input validation and error handling mechanisms are in place. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mozjpeg →
FAQ
mozjpeg is a Rust interface for the MozJPEG library, which is a JPEG encoder that aims to improve compression efficiency.
Versions of mozjpeg prior to 0.8.19 are affected by this vulnerability.
The vulnerability can lead to memory corruption, crashes, or even potential code execution vulnerabilities.
To fix the vulnerability, update the mozjpeg crate to version 0.8.19 or later and review the project code for any potential unsafe usage.
There is no known workaround for this vulnerability. Updating the mozjpeg crate is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for mozjpeg.
