LibJXL JPEG Decoder out-of-bounds write

Summaryinfo

A vulnerability has been found in LibJXL and classified as critical. This impacts an unknown function of the component JPEG Decoder. This manipulation causes out-of-bounds write. The identification of this vulnerability is CVE-2024-11403. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in LibJXL (the affected version unknown). It has been declared as problematic. Affected by this vulnerability is an unknown part of the component JPEG Decoder. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality. The summary by CVE is:

There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.

The advisory is shared at github.com. This vulnerability is known as CVE-2024-11403 since 11/19/2024. The exploitation appears to be difficult. The attack can be launched remotely. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 212346 (openSUSE 15 Security Update : qt6-webengine (openSUSE-SU-2024:0402-1)), which helps to determine the existence of the flaw in a target environment.

Applying the patch 9cc451b91b74ba470fd72bd48c121e9f33d24c99 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (212346). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• LibJXL

License

• open-source

Website

• Product: https://github.com/libjxl/libjxl/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion