PT-2023-16422 · Libjxl+5 · Libjxl+5

Published 2023-02-04 · Updated 2025-08-07 · CVE-2023-0645

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions libjxl versions prior to 0.8.1

Description An out of bounds read exists in libjxl. An attacker using a specifically crafted file could cause an out of bounds read in the exif handler.

Recommendations For versions prior to 0.8.1, we recommend upgrading to version 0.8.1 or applying the changes from the commit https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159 to fix the issue. As a temporary workaround, consider restricting the use of specifically crafted files that could cause an out of bounds read in the exif handler until a patch is available.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2023-1180

BDU:2025-11754

CVE-2023-0645

DSA-5958-1

USN-7637-1

Affected Products

Alt Linux

Debian

Linuxmint

Red Os

Ubuntu

Libjxl

References · 20

• https://github.com/libjxl/libjxl/pull/2101 · Patch
• https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159 · Patch
• https://ubuntu.com/security/CVE-2024-11403 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0645 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-0645 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-0645 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7637-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-11498 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-0645 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-0645 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5958-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7637-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0645 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0645 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-35790 · Vendor Advisory