PT-2021-21308 · Libjxl · Libjxl

Cagelight · Published 2021-08-30 · Updated 2021-09-07 · CVE-2021-36692

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libjxl version 0.3.7

Description The issue is a Divide By Zero error in the jxl::DecodeImageAPNG() function located in lib/extras/codec apng.cc. This error can be triggered when encoding a malicious APNG file using cjxl, allowing an attacker to cause a denial of service.

Recommendations For libjxl version 0.3.7, consider disabling the jxl::DecodeImageAPNG() function until a patch is available to prevent the denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

CVE-2021-36692

Affected Products

Libjxl

References · 7

• 🔥 https://github.com/libjxl/libjxl/issues/308 · Exploit
• https://github.com/libjxl/libjxl/pull/313 · Patch
• https://github.com/libjxl/libjxl/commit/7dfa400ded53919d986c5d3d23446a09e0cf481b · Patch
• https://osv.dev/vulnerability/CVE-2021-36692 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36692 · Security Note
• https://t.me/cibsecurity/28051 · Telegram Post
• https://t.me/cvenotify/20403 · Telegram Post