PT-2022-17568 · Jpeg Js · Jpeg-Js

Sohom Datta · Published 2022-06-10 · Updated 2022-06-17 · CVE-2022-25851

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions jpeg-js versions prior to 0.4.4

Description The issue allows a Denial of Service (DoS) where a particular piece of input will cause the program to enter an infinite loop and never return.

Recommendations For versions prior to 0.4.4, update to version 0.4.4 or later to resolve the issue.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2022-25851

GHSA-XVF7-4V9Q-58W6

SNYK-JAVA-ORGWEBJARSNPM-2860295

SNYK-JS-JPEGJS-2859218

Affected Products

Jpeg-Js

References · 10

• 🔥 https://github.com/jpeg-js/jpeg-js/issues/105 · Exploit
• https://github.com/jpeg-js/jpeg-js/commit/9ccd35fb5f55a6c4f1902ac5b0f270f675750c27 · Patch
• https://github.com/jpeg-js/jpeg-js/pull/106 · Patch
• https://osv.dev/vulnerability/CVE-2022-25851 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25851 · Security Note
• https://osv.dev/vulnerability/GHSA-xvf7-4v9q-58w6 · Vendor Advisory
• https://github.com/jpeg-js/jpeg-js · Note
• https://snyk.io/vuln/SNYK-JS-JPEGJS-2859218 · Note
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2860295 · Note
• https://t.me/cibsecurity/44226 · Telegram Post