CVE-2023-35790: Integer Underflow

Q: What is the severity of CVE-2023-35790?

CVE-2023-35790 is classified as a denial of service vulnerability due to an integer underflow in libjxl.

Q: How do I fix CVE-2023-35790?

To fix CVE-2023-35790, update libjxl to version 0.8.2 or later.

Q: What causes the denial of service in CVE-2023-35790?

CVE-2023-35790 causes denial of service through an integer underflow during patch decoding.

Q: Which versions of libjxl are affected by CVE-2023-35790?

CVE-2023-35790 affects all versions of libjxl prior to 0.8.2.

Q: Can CVE-2023-35790 lead to security repercussions?

Yes, CVE-2023-35790 can lead to an infinite loop, resulting in a denial of service condition.

Published Jun 16, 2023

Updated

An issue was discovered in decpatchdictionary.cc in libjxl before 0.8.2. An integer underflow in patch decoding can lead to a denial of service, such as an infinite loop.

Affected Software

2 affected componentsFixes available

Libjxl Project Libjxl<0.8.2

debian/jpeg-xl

0.7.0-10+deb12u10.11.2-0.1~deb13u20.11.2-0.1~deb13u30.11.2-5.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/jpeg-xl to a version that resolves this vulnerability.
Fixed in 0.7.0-10+deb12u1Fixed in 0.11.2-0.1~deb13u2Fixed in 0.11.2-0.1~deb13u3Fixed in 0.11.2-5.1
Upgrade
Upgrade libjxl to a version that resolves this vulnerability.
Fixed in 0.8.2

Event History

Jun 16, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·09:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-5958

Frequently Asked Questions

What is the severity of CVE-2023-35790?

CVE-2023-35790 is classified as a denial of service vulnerability due to an integer underflow in libjxl.

How do I fix CVE-2023-35790?