Vulnerability · Published Nov 25, 2024 · Assigned by Google
CVE-2024-11498Resource exhaustion via Stack overflow in libjxl
Medium 6.9
In plain English
A medium-severity uncontrolled resource consumption in libjxl from libjxl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend upgrading past commit 65fbec56bc578b6b6ee02a527be70787bbd053b0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | libjxl | 0.10.4-r0 | ALPINE-CVE-2024-11498 |
| Alpine:v3.23 | libjxl | 0.11.1-r0 | ALPINE-CVE-2024-11498 |
| Alpine:v3.24 | libjxl | 0.11.1-r0 | ALPINE-CVE-2024-11498 |
| Debian:12 | jpeg-xl | 0.7.0-10+deb12u1 | DSA-5958-1 |
| Debian:12 | jpeg-xl | 0.7.0-10+deb12u1 | DEBIAN-CVE-2024-11498 |
| Debian:13 | jpeg-xl | 0.10.4-2 | DEBIAN-CVE-2024-11498 |
| Debian:14 | jpeg-xl | 0.10.4-2 | DEBIAN-CVE-2024-11498 |
| Ubuntu:24.04:LTS | jpeg-xl | 0.7.0-10.2ubuntu6.1 | UBUNTU-CVE-2024-11498 |
| Ubuntu:24.04:LTS | jpeg-xl | 0.7.0-10.2ubuntu6.1 | USN-7637-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| libjxl | libjxl | 0.11.0 – before 65fbec56bc578b6b6ee02a527be70787bbd053b00.10.0-2 – before 65fbec56bc578b6b6ee02a527be70787bbd053b00.9.0-3 – before 65fbec56bc578b6b6ee02a527be70787bbd053b00.8.0-3 – before 65fbec56bc578b6b6ee02a527be70787bbd053b00.7.0-1 – before 65fbec56bc578b6b6ee02a527be70787bbd053b0 |
Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H