PT-2024-9202
CVE-2024-11403
·
تاريخ النشر
2024-10-03
·
تاريخ التحديث
2026-03-10
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99
libjpeg (affected versions not specified)
libmozjs-115-0-115.15.0-4.1
libmozjs-128-0-128.5.1-3.1
libjxl-devel-0.11.1-1.1
qt6-webengine
Description
An out-of-bounds read/write vulnerability exists in the JPEG decoder used by the JPEG XL encoder when performing JPEG recompression on untrusted input. This occurs due to improper bounds checking in the presence of incomplete codes, potentially leading to an out-of-bounds write. The same vulnerability is present in jpegli, potentially causing it to read uninitialized memory or function addresses.
Recommendations
LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99: Update to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99 or a later version.
libjpeg: Update to the latest version.
libmozjs-115-0-115.15.0-4.1: Update to the latest version.
libmozjs-128-0-128.5.1-3.1: Update to the latest version.
libjxl-devel-0.11.1-1.1: Update to the latest version.
qt6-webengine: Update to the latest version.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾