Multiple Vulnerabilities in jpeg-xl (CVE-2021-27804)

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->
<a href="/fulldisclosure/"><img src="/images/fulldisclosure-logo.png" class="l-logo right" alt="fulldisclosure logo" width="80"></a>
<h2 class="m-list"><a href="/fulldisclosure/">Full Disclosure</a>
mailing list archives</h2>
<!--X-User-Header-End-->
<!--X-TopPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="1"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#2">By Date</a>
<a href="3"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="1"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#2">By Thread</a>
<a href="3"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<form class="nst-search center" action="/search/fulldisclosure">
<input class="nst-search-q" name="q" type="search" placeholder="List Archive Search">
<button class="nst-search-button" title="Search">
<img style="width:100%;aspect-ratio:1/1;" alt="" aria-hidden="true" src="/shared/images/nst-icons.svg#search">
</button>
</form>

</div>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
<h1 class="m-title">Multiple Vulnerabilities in jpeg-xl (CVE-2021-27804)</h1>
<hr>
<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->


<em>From</em>: Marc &lt;mh () mh-sec de&gt;


<em>Date</em>: Sat, 27 Feb 2021 12:33:42 +0100


<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->
<hr>
<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
<pre style="margin: 0em;">
Multiple Vulnerabilities in jpeg-xl
===================================
CVE: CVE-2021-27804
Highest Severity Rating: High
Confirmed Affected Versions: jpeg-xl v0.3.1 and earlier
Vendor: Joint Photographic Experts Group (JPEG)
Vendor URL: <a rel="nofollow" href="https://gitlab.com/wg1/jpeg-xl">https://gitlab.com/wg1/jpeg-xl</a>


Summary and Impact
------------------
jpeg-xl is the reference implementation by the Joint Photographic
Experts Group (JPEG) of the new JPEG XL standard.
Multiple memory corruption vulnerabilities were found and reported in
the last 3 months. The security issues were responsively reported to
the vendor and were fixed in subsequent version, however silently.

The changelog does not reflect security issues being fixed:

jpeg-xl (0.3.2) urgency=medium

  * Bump JPEG XL version to 0.3.2.
  * Fix embedded ICC encoding regression #149.

 -- Fri, 12 Feb 2021 21:00:12 +0100

jpeg-xl (0.3.1) urgency=medium

  * Bump JPEG XL version to 0.3.1.

 -- Tue, 09 Feb 2021 09:48:43 +0100

jpeg-xl (0.3) urgency=medium

  * Bump JPEG XL version to 0.3.

 -- Wed, 27 Jan 2021 22:36:32 +0100

All the while it is already being available e.g. in Arch Linux
(<a rel="nofollow" href="https://aur.archlinux.org/packages/libjpeg-xl-git/">https://aur.archlinux.org/packages/libjpeg-xl-git/</a>) and FreeBSD
(<a rel="nofollow" href="https://pkgs.org/download/jpeg-xl">https://pkgs.org/download/jpeg-xl</a>) and is currently in the process of
being added to Debian and therefore to Ubuntu and Kali Linux.

Hence the need to sit down and write a boring advisory to publish on a
mailing list instead of doing something more interesting :(

For anyone interested, the memory corruptions were discovered by using
the AFL++ fuzzer (<a rel="nofollow" href="https://github.com/AFLplusplus/AFLplusplus">https://github.com/AFLplusplus/AFLplusplus</a>) for just a
few hours for testing purposes. The current v0.3.2 release of jpeg-xl
also produces writeable memory corruptions when fuzzing for a very short
time (with a good starting corpus that is).


Recommendation
--------------
The vendor should establish a proper notification on fixed security
issues in the changelog and not put the Internet at risk.


-- 
Marc Heuse
www.mh-sec.de

PGP: AF3D 1D4C D810 F0BB 977D  3807 C7EE D0A0 6BE9 F573

_______________________________________________
Sent through the Full Disclosure mailing list
<a rel="nofollow" href="https://nmap.org/mailman/listinfo/fulldisclosure">https://nmap.org/mailman/listinfo/fulldisclosure</a>
Web Archives &amp; RSS: <a rel="nofollow" href="http://seclists.org/fulldisclosure/">http://seclists.org/fulldisclosure/</a>

</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="1"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#2">By Date</a>
<a href="3"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="1"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#2">By Thread</a>
<a href="3"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
</div>
<h3 class="m-thread">Current thread:</h3>
<ul class="thread">
<li><strong>Multiple Vulnerabilities in jpeg-xl (CVE-2021-27804)</strong> <em>Marc (Mar 02)</em>
</li></ul>


<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
<p>