Vulnerability · Published Apr 11, 2023 · Assigned by Google
CVE-2023-0645Out of Bounds read in libjxl
Medium 5.3
In plain English
A medium-severity out-of-bounds read in Libjxl from Libjxl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An out of bounds read exists in libjxl. An attacker using a specifically crafted file could cause an out of bounds read in the exif handler. We recommend upgrading to version 0.8.1 or past commit https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159 https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | jpeg-xl | 0.7.0-10+deb12u1 | DEBIAN-CVE-2023-0645 |
| Debian:12 | jpeg-xl | 0.7.0-10+deb12u1 | DSA-5958-1 |
| Debian:13 | jpeg-xl | 0.8.2-4 | DEBIAN-CVE-2023-0645 |
| Debian:14 | jpeg-xl | 0.8.2-4 | DEBIAN-CVE-2023-0645 |
| Ubuntu:24.04:LTS | jpeg-xl | 0.7.0-10.2ubuntu6.1 | USN-7637-1 |
| Ubuntu:24.04:LTS | jpeg-xl | 0.7.0-10.2ubuntu6.1 | UBUNTU-CVE-2023-0645 |
Affected products (as reported)
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N