Bug 1212492 (CVE-2023-35790)

Summary:	VUL-0: CVE-2023-35790: libjxl: integer underflow bug in patch decoding
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Robert Frohl <rfrohl>
Component:	Incidents	Assignee:	Jiri Srain <jsrain>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	jengelh, meissner
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/369798/
Whiteboard:
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Robert Frohl 2023-06-19 07:40:02 UTC

Security: Fix an integer underflow bug in patch decoding (#2551).

https://github.com/libjxl/libjxl/releases/tag/v0.8.2
https://github.com/libjxl/libjxl/pull/2551

Comment 2 Robert Frohl 2023-06-19 10:10:31 UTC

Fixed in openSUSE:Factory

adding jengelh for visibility

Comment 3 OBSbugzilla Bot 2023-06-19 11:55:02 UTC

This is an autogenerated message for OBS integration:
This bug (1212492) was mentioned in
https://build.opensuse.org/request/show/1093764 Backports:SLE-15-SP5 / libjxl

Comment 4 Marcus Meissner 2023-06-19 12:36:37 UTC

(i put CVE and bug into the patchinfo for 15-sp5)

Comment 5 Marcus Meissner 2023-06-29 19:05:30 UTC

openSUSE-SU-2023:0161-1: An update that fixes one vulnerability is now available.\n\nCategory: security (moderate)\nBug References: 1212492\nCVE References: CVE-2023-35790\nJIRA References: \nSources used:\nopenSUSE Backports SLE-15-SP5 (src):    libjxl-0.8.2-bp155.2.3.1\n\n