Memory Corruption Vulnerability in JPEG XL Library by Open Source Contributors
CVE-2021-27804

9.8CRITICAL

Key Information:

Vendor

Libjxl Project

Status
Libjxl
Vendor
CVE Published:
2 March 2021

What is CVE-2021-27804?

The JPEG XL library, specifically versions up to 0.3.2, contains a vulnerability that allows for writable memory corruption. This issue can potentially be exploited to manipulate memory allocations, leading to severe consequences such as unauthorized access to sensitive information or system crashes. Users of affected versions should upgrade to the latest version immediately to mitigate risks.

References

https://gitlab.com/wg1/jpeg-xl/-/tags
x_refsource_MISC
http://www.openwall.com/lists/oss-security/2021/03/01/3
x_refsource_MISC
http://seclists.org/fulldisclosure/2021/Mar/2
mailing-listx_refsource_FULLDISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.