Segv on unknown address in libvips: jxl::N_AVX2::XYBStage<jxl::N_AVX2::PerChannelOp<jxl::N_AVX2::Op709> >::ProcessRo
Summary
OSV-2022-493: OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48132 Crash type: Segv on unknown address Crash state: jxl::N_AVX2::XYBStage::ProcessRo jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRender... Affects libvips versions >= d91cfa4e5346d4abd71e0b6d908112663a53a5c2, < 55cbde674be27fcb4f79023e8cf1d3ec1291d4fd. Fixed in 55cbde674be27fcb4f79023e8cf1d3ec1291d4fd. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libvips is an open-source image processing library that provides a wide range of functionalities for manipulating images. It is commonly used in various applications and frameworks to perform tasks such as resizing, cropping, and applying filters to images. This vulnerability affects libvips and can lead to a segmentation fault (segv) when processing certain image data.
Vulnerability Detail
The vulnerability occurs in the XYBStage::ProcessRo function of the libvips library. When processing image data, a segmentation fault can occur at an unknown address, resulting in a crash. This vulnerability can be triggered by specific inputs and may allow an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code in the context of the application using libvips. The issue was reported through the OSS-Fuzz project.
How To Fix
Minimum fixed version
55cbde674be27fcb4f79023e8cf1d3ec1291d4fd
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if updating libvips is not immediately feasible, it is recommended to avoid processing untrusted or unknown image data using the affected library. By ensuring that only trusted and validated image data is processed, the risk of triggering the vulnerability can be mitigated.
Conclusion
The vulnerability in libvips can lead to crashes and potential security risks in applications utilizing the library for image processing. It is crucial to update to a fixed version of libvips or apply the recommended workaround to mitigate the risk. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for libvips →
FAQ
libvips is an open-source image processing library used for various image manipulation tasks.
This vulnerability can lead to a crash (segv) in applications using libvips, potentially causing a denial-of-service (DoS) condition or enabling arbitrary code execution.
This vulnerability was reported through the OSS-Fuzz project, which focuses on finding security vulnerabilities in open-source software through fuzzing techniques.
To fix this vulnerability, update libvips to a version that includes the fix (commit 55cbde674be27fcb4f79023e8cf1d3ec1291d4fd or later).
As a workaround, avoid processing untrusted or unknown image data using libvips until the library is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for libvips.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
