Heap-buffer-overflow in libjxl: jxl::BitsCoder::Read
Summary
OSV-2022-492: Heap-buffer-overflow in jxl::BitsCoder::Read. Affects libjxl versions >= b7076f1869914eee47b3eae107750f3a3ce43a76, < 746d1f5e8498f501238894899c301e70ea57e2aa. Fixed in 746d1f5e8498f501238894899c301e70ea57e2aa. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libjxl is an open-source library for JPEG XL image format. It provides functionality for encoding and decoding images in the JPEG XL format. The library is widely used in various applications that deal with image processing and manipulation. However, a vulnerability has been discovered in the library that can lead to a heap-buffer-overflow when reading data.
Vulnerability Detail
The vulnerability in libjxl, specifically in the jxl::BitsCoder::Read function, allows for a heap-buffer-overflow when reading 8 bytes of data. This can result in a crash or potentially lead to arbitrary code execution. The vulnerability was reported through the OSS-Fuzz project and has been assigned the identifier OSV-2022-492. The affected version range of libjxl is from commit b7076f1 to commit 746d1f5.
How To Fix
Minimum fixed version
746d1f5e8498f501238894899c301e70ea57e2aa
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid triggering the heap-buffer-overflow by refraining from using the specific functionality related to jxl::BitsCoder::Read. However, this may limit the full functionality of libjxl in certain scenarios.
Conclusion
In conclusion, libjxl is affected by a heap-buffer-overflow vulnerability in the jxl::BitsCoder::Read function. Users are advised to update to a fixed version or apply the recommended workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libjxl →
FAQ
libjxl is an open-source library for encoding and decoding images in the JPEG XL format. It is widely used in various image processing applications.
The vulnerability can lead to a heap-buffer-overflow, potentially resulting in a crash or arbitrary code execution.
The vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software.
To fix the vulnerability, update libjxl to a version that includes the fix commit 746d1f5 or later.
A temporary workaround is to avoid using the specific functionality related to jxl::BitsCoder::Read.
References
Related vulnerabilities
Recent vulnerabilities recorded for libjxl.
