PT-2021-15142 · Libjxl · Libjxl

Lovello · Published 2021-11-01 · Updated 2021-11-03 · CVE-2021-22563

Positive Technologies (AI Summary)

CVSS v3.1

4.5

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions libjxl versions prior to 0.6.0

Description The issue arises from invalid JPEG XL images that can cause an out of bounds access on a std::vector<std::vector<T>> when rendering splines using libjxl. This out of bounds read access can lead to a segfault or result in rendering splines based on other process memory.

Recommendations For libjxl versions prior to 0.6.0, upgrade to a version past 0.6.0 to resolve the issue. As a temporary workaround, consider restricting the use of libjxl for rendering splines from untrusted sources until a patch is applied.

Exploit

Fix

Buffer Over-read

Out of bounds Read

Weakness Enumeration

CWE-126

CWE-125

Related Identifiers

CVE-2021-22563

Affected Products

Libjxl

References · 5

• 🔥 https://github.com/libjxl/libjxl/issues/735 · Exploit
• https://github.com/libjxl/libjxl/pull/757 · Patch
• https://osv.dev/vulnerability/CVE-2021-22563 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22563 · Security Note
• https://t.me/cibsecurity/31541 · Telegram Post