Details have been revealed about two vulnerabilities in the JPEG XL decoder included in the FFmpeg package, which could allow an attacker to execute code when processing specially crafted images in FFmpeg. These issues were resolved in the FFmpeg 6.1 release, but since support for JPEG XL is included starting from branch 6.1, the vulnerability only affects systems using experimental builds of FFmpeg 6.1 or carrying changes from it.
The first vulnerability (CVE-2024-22860) is caused by an integer overflow in the JPEG XL parser, resulting from a lack of bounds checking on the int type size. The second vulnerability (CVE-2024-22862) arose due to an integer overflow in the jpegxl_anim_read_packet function used for decoding animation and is linked to the use of the signed int64_t type instead of the unsigned uint64_t. These issues are specific to FFmpeg, and do not appear in the reference implementation of libjxl.
Bron: opennet.ru
