Bug 1212492 (CVE-2023-35790) - VUL-0: CVE-2023-35790: libjxl: integer underflow bug in patch decoding
Summary: VUL-0: CVE-2023-35790: libjxl: integer underflow bug in patch decoding
Status: NEW
Alias: CVE-2023-35790
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Jiri Srain
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/369798/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-06-19 07:40 UTC by Robert Frohl
Modified: 2023-06-29 19:05 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2023-06-19 07:40:02 UTC 
Security: Fix an integer underflow bug in patch decoding (#2551).

https://github.com/libjxl/libjxl/releases/tag/v0.8.2
https://github.com/libjxl/libjxl/pull/2551
Comment 2 Robert Frohl 2023-06-19 10:10:31 UTC 
Fixed in openSUSE:Factory

adding jengelh for visibility
Comment 3 OBSbugzilla Bot 2023-06-19 11:55:02 UTC 
This is an autogenerated message for OBS integration:
This bug (1212492) was mentioned in
https://build.opensuse.org/request/show/1093764 Backports:SLE-15-SP5 / libjxl
Comment 4 Marcus Meissner 2023-06-19 12:36:37 UTC 
(i put CVE and bug into the patchinfo for 15-sp5)
Comment 5 Marcus Meissner 2023-06-29 19:05:30 UTC 
openSUSE-SU-2023:0161-1: An update that fixes one vulnerability is now available.\n\nCategory: security (moderate)\nBug References: 1212492\nCVE References: CVE-2023-35790\nJIRA References: \nSources used:\nopenSUSE Backports SLE-15-SP5 (src):    libjxl-0.8.2-bp155.2.3.1\n\n