CVE-2024-11498

Name	CVE-2024-11498
Description	There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend upgrading past commit 65fbec56bc578b6b6ee02a527be70787bbd053b0.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1088818

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
jpeg-xl (PTS)	bookworm	0.7.0-10	vulnerable
	sid, trixie	0.9.2-10	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
jpeg-xl	source	experimental	0.10.4-1
jpeg-xl	source	(unstable)	(unfixed)			1088818

Notes

[bookworm] - jpeg-xl <no-dsa> (Minor issue)
https://github.com/libjxl/libjxl/pull/3943
https://github.com/libjxl/libjxl/commit/bf4781a2eed2eef664790170977d1d3d8347efb9