OSV-2022-725 Heap-buffer-overflow in jxl::N_EMU128::WriteToU8Stage::ProcessRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50295 Crash type: Heap-buffer-overflow WRITE 1 Crash state: jxl::NEMU128::WriteToU8Stage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-608 Heap-use-after-free in jxl::WriteToPixelCallbackStage::ProcessRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277 Crash type: Heap-use-after-free READ 4 Crash state: jxl::WriteToPixelCallbackStage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-580 Heap-buffer-overflow in jxl::N_AVX2::BlendingStage::ProcessPaddingRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49049 Crash type: Heap-buffer-overflow WRITE Crash state: jxl::NAVX2::BlendingStage::ProcessPaddingRow jxl::LowMemoryRenderPipeline::RenderPadding jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-493 Segv on unknown address in jxl::N_AVX2::XYBStage<jxl::N_AVX2::PerChannelOp<jxl::N_AVX2::Op709> >::ProcessRo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48132 Crash type: Segv on unknown address Crash state: jxl::NAVX2::XYBStage ::ProcessRo jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-492 Heap-buffer-overflow in jxl::BitsCoder::Read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48123 Crash type: Heap-buffer-overflow READ 8 Crash state: jxl::BitsCoder::Read jxl::ReadVisitor::Bits jxl::jpeg::JPEGData::VisitFields...

OSV-2022-371 Segv on unknown address in jxl::N_AVX2::WriteToU8Stage::ProcessRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46963 Crash type: Segv on unknown address Crash state: jxl::NAVX2::WriteToU8Stage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-367 Segv on unknown address in jxl::N_SSE4::WriteToU8Stage::ProcessRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46915 Crash type: Segv on unknown address Crash state: jxl::NSSE4::WriteToU8Stage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-305 Heap-buffer-overflow in jxl::N_AVX2::BlendingStage::ProcessPaddingRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46304 Crash type: Heap-buffer-overflow READ Crash state: jxl::NAVX2::BlendingStage::ProcessPaddingRow jxl::LowMemoryRenderPipeline::RenderPadding jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-296 Negative-size-param in jxl::N_SSE4::BlendingStage::ProcessPaddingRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46243 Crash type: Negative-size-param Crash state: jxl::NSSE4::BlendingStage::ProcessPaddingRow jxl::LowMemoryRenderPipeline::RenderPadding jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-265 Heap-buffer-overflow in jxl::WriteToPixelCallbackStage::ProcessRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45833 Crash type: Heap-buffer-overflow READ 4 Crash state: jxl::WriteToPixelCallbackStage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-264 Heap-buffer-overflow in jxl::N_AVX2::BlendingStage::ProcessRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45822 Crash type: Heap-buffer-overflow READ 4 Crash state: jxl::NAVX2::BlendingStage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

Out-of-bounds

libjxl b02d6b9, as used in libvips 8.11 through 8.11.2 and other products, has an out-of-bounds write in jxl::ModularFrameDecoder::DecodeGroup called from jxl::FrameDecoder::ProcessACGroup and jxl::ThreadPool::RunCallStatejxl::FrameDecoder::ProcessSections...

OSV-2021-1748 Heap-buffer-overflow in jxl::N_AVX2::FloatToRGBA8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42839 Crash type: Heap-buffer-overflow WRITE 1 Crash state: jxl::NAVX2::FloatToRGBA8 jxl::FinalizeImageRect jxl::ThreadPool::RunCallStatejxl::FinalizeFrameDecoding...

OSV-2021-1644 Container-overflow in void jxl::CopyImageTo<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41608 Crash type: Container-overflow READ 4 Crash state: void jxl::CopyImageTo jxl::ModularFrameDecoder::DecodeGroup jxl::FrameDecoder::ProcessACGroup...

OSV-2021-1607 Container-overflow in void jxl::CopyImageTo<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41235 Crash type: Container-overflow READ 4 Crash state: void jxl::CopyImageTo jxl::ModularFrameDecoder::DecodeGroup jxl::FrameDecoder::ProcessACGroup...

OSV-2021-1606 Segv on unknown address in jxl::N_AVX2::SingleFromSingle

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41233 Crash type: Segv on unknown address Crash state: jxl::NAVX2::SingleFromSingle jxl::ThreadPool::SequentialRunnerStatic jxl::ModularFrameDecoder::ModularImageToDecodedRect...

OSV-2021-1604 Heap-buffer-overflow in jxl::N_AVX2::SingleFromSingle

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41225 Crash type: Heap-buffer-overflow READ Crash state: jxl::NAVX2::SingleFromSingle jxl::ThreadPool::SequentialRunnerStatic jxl::ModularFrameDecoder::ModularImageToDecodedRect...

DEBIAN-CVE-2021-36691

libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase. When encoding a malicous GIF file using cjxl, an attacker can trigger a denial of service...

CVE-2021-36691

libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase. When encoding a malicous GIF file using cjxl, an attacker can trigger a denial of service...

OSV-2021-1054 Heap-buffer-overflow in jxl::N_SCALAR::SingleFromSingle

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36490 Crash type: Heap-buffer-overflow WRITE 4 Crash state: jxl::NSCALAR::SingleFromSingle jxl::ThreadPool::SequentialRunnerStatic jxl::ModularFrameDecoder::ModularImageToDecodedRect...