[<prev] [next>] [day] [month] [year] [list]
Message-ID: <9c3be1f8-052f-f034-5026-22ab4ecff61b@mh-sec.de>
Date: Mon, 1 Mar 2021 15:48:57 +0100
From: Marc <mh@...sec.de>
To: oss-security@...ts.openwall.com
Subject: Multiple Vulnerabilities in jpeg-xl (CVE-2021-27804)
Multiple Vulnerabilities in jpeg-xl
===================================
CVE: CVE-2021-27804
Highest Severity Rating: High
Confirmed Affected Versions: jpeg-xl v0.3.1 and earlier
Vendor: Joint Photographic Experts Group (JPEG)
Vendor URL: https://gitlab.com/wg1/jpeg-xl
Summary and Impact
------------------
jpeg-xl is the reference implementation by the Joint Photographic
Experts Group (JPEG) of the new JPEG XL standard.
Multiple memory corruption vulnerabilities were found and reported in
the last 3 months. The security issues were responsively reported to
the vendor and were fixed in subsequent version, however silently.
The changelog does not reflect security issues being fixed:
jpeg-xl (0.3.2) urgency=medium
* Bump JPEG XL version to 0.3.2.
* Fix embedded ICC encoding regression #149.
-- Fri, 12 Feb 2021 21:00:12 +0100
jpeg-xl (0.3.1) urgency=medium
* Bump JPEG XL version to 0.3.1.
-- Tue, 09 Feb 2021 09:48:43 +0100
jpeg-xl (0.3) urgency=medium
* Bump JPEG XL version to 0.3.
-- Wed, 27 Jan 2021 22:36:32 +0100
All the while it is already being available e.g. in Arch Linux
(https://aur.archlinux.org/packages/libjpeg-xl-git/) and FreeBSD
(https://pkgs.org/download/jpeg-xl) and is currently in the process of
being added to Debian and therefore to Ubuntu and Kali Linux.
Hence the need to sit down and write a boring advisory to publish on a
mailing list instead of doing something more interesting :(
For anyone interested, the memory corruptions were discovered by using
the AFL++ fuzzer (https://github.com/AFLplusplus/AFLplusplus) for just a
few hours for testing purposes. The current v0.3.2 release of jpeg-xl
also produces writeable memory corruptions when fuzzing for a very short
time (with a good starting corpus that is).
Recommendation
--------------
The vendor should establish a proper notification on fixed security
issues in the changelog and not put the Internet at risk.
--
Marc Heuse
www.mh-sec.de
PGP: AF3D 1D4C D810 F0BB 977D 3807 C7EE D0A0 6BE9 F573
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
