{"id":"CVE-2024-11403","aliases":["ALPINE-CVE-2024-11403","DEBIAN-CVE-2024-11403","DSA-5958-1","EUVD-2024-33796","GHSA-5pp5-4vfv-784q","MGASA-2025-0008","SUSE-SU-2024:4411-1","SUSE-SU-2025:01883-1","UBUNTU-CVE-2024-11403","USN-7637-1","openSUSE-SU-2024:0402-1","openSUSE-SU-2024:14531-1","openSUSE-SU-2024:14594-1","openSUSE-SU-2024:14600-1","openSUSE-SU-2025:0139-1"],"status":"published","title":"Out of Bounds Memory Read/Write in libjxl","description":"There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00631,"percentile":0.50531,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-787"],"published":"2024-11-25T13:08:38Z","modified":"2026-11-03T06:32:44Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"libjxl","fixed_in":["0.10.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libjxl","fixed_in":["0.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libjxl","fixed_in":["0.11.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"jpeg-xl","fixed_in":["0.7.0-10+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jpeg-xl","fixed_in":["0.10.4-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jpeg-xl","fixed_in":["0.10.4-2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libjxl","fixed_in":["0.10.3-150700.4.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"jpeg-xl","fixed_in":["0.7.0-10.2ubuntu6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP5","package":"qt6-webengine","fixed_in":["6.4.2-bp155.2.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP5","package":"qt6-webengine-docs","fixed_in":["6.4.2-bp155.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"qt6-webengine","fixed_in":["6.4.2-bp155.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"qt6-webengine-docs","fixed_in":["6.4.2-bp155.2.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-10+deb12u1"}]}],"versions":["0.7.0-10"]},{"source":"osv","ecosystem":"Debian:13","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-10+deb12u1"}]}],"versions":["0.7.0-10"],"bundled":4},{"source":"osv","ecosystem":"Mageia:9","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.4.0-150600.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.4.0-150600.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3-150700.4.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-10.2ubuntu6.1"}]}],"versions":["0.7.0-10ubuntu2","0.7.0-10.2ubuntu1","0.7.0-10.2ubuntu4","0.7.0-10.2ubuntu5","0.7.0-10.2ubuntu6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-10.2ubuntu6.1"}]}],"versions":["0.7.0-10ubuntu2","0.7.0-10.2ubuntu1","0.7.0-10.2ubuntu4","0.7.0-10.2ubuntu5","0.7.0-10.2ubuntu6"],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"qt6-webengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-bp155.2.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"qt6-webengine-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-bp155.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"qt6-webengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-bp155.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"qt6-webengine-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-bp155.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.15.0-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozjs128","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.5.1-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-bp156.3.3.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"libjxl-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-bp156.3.3.4"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-bp156.3.3.4"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libjxl-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-bp156.3.3.4"}]}],"bundled":2}],"products":[{"vendor":"google","product":"libjxl"},{"vendor":"libjxl","product":"libjxl"},{"vendor":"libjxl_project","product":"libjxl"}],"references":[{"url":"https://github.com/libjxl/libjxl/commit/9cc451b91b74ba470fd72bd48c121e9f33d24c99","tags":["Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11403","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5pp5-4vfv-784q"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-11403","tags":["advisory"]},{"url":"https://github.com/libjxl/libjxl/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11403.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-11403","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0008.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33818","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/MKE5FX6CYNU67TGCF7WUASGPHZHN5WQC/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244411-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1232599","tags":["report"]},{"url":"https://bugzilla.suse.com/1232602","tags":["report"]},{"url":"https://bugzilla.suse.com/1233766","tags":["report"]},{"url":"https://bugzilla.suse.com/1233786","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50602","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501883-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1233768","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-11403","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-11403","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7637-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-0645","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-35790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-11498","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TGCRWIE4IMT4IZHYUTUPMPDFR46SJODV/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1233764","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MKE5FX6CYNU67TGCF7WUASGPHZHN5WQC/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/A6B7Y4KGXKAS65P4DWUYPMSZQU4A7ZBP/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MF2M2SVCJLFCMVUJBZPKNUD26RAA7I4W/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1233785","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-11403","title":"Out of Bounds Memory Read/Write in libjxl","description":"There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.","status":"published","published":"2024-11-25T13:08:38.28Z","modified":"2024-11-25T13:54:29.806Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-787","CWE-125"],"updated_at":"2026-11-02T14:34:19.615831Z"}],"euvd":[{"id":"EUVD-2024-33796","description":"There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.","status":"published","published":"2024-11-25T13:08:38Z","modified":"2024-11-25T13:54:29Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-03T00:04:49.212921Z"}],"ghsa":[{"id":"GHSA-5pp5-4vfv-784q","title":"There exists an out of bounds read/write in LibJXL versions prior to commit...","description":"There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.","status":"published","published":"2024-11-25T18:33:26Z","modified":"2025-07-23T21:37:47Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:03:06.223067Z"}],"nvd":[{"id":"CVE-2024-11403","description":"There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.","status":"published","published":"2024-11-25T14:15:06.31Z","modified":"2026-06-17T06:57:41.693Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T14:10:38.347238Z"}],"osv":[{"id":"ALPINE-CVE-2024-11403","description":"There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.","status":"published","published":"2024-11-25T14:15:06.31Z","modified":"2026-11-03T06:32:44.866188165Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"CVE-2024-11403","title":"Out of Bounds Memory Read/Write in libjxl","description":"There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.","status":"published","published":"2024-11-25T13:08:38.28Z","modified":"2026-10-28T10:40:58.488424708Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T15:44:37.180532Z"},{"id":"DEBIAN-CVE-2024-11403","description":"There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.","status":"published","published":"2024-11-25T14:15:06.31Z","modified":"2026-11-02T12:00:38.307588039Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"UBUNTU-CVE-2024-11403","description":"There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.","status":"published","published":"2024-11-25T14:15:00Z","modified":"2026-04-22T14:37:08.098296Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"DSA-5958-1","title":"jpeg-xl - security update","status":"published","published":"2025-07-04T00:00:00Z","modified":"2026-03-09T02:08:56.665475Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0008","title":"Updated libjxl packages fix security vulnerabilities","description":"Out of Bounds Memory Read/Write in libjxl. (CVE-2024-11403)\nResource exhaustion via Stack overflow in libjxl. (CVE-2024-11498)\n","status":"published","published":"2025-01-12T06:41:01Z","modified":"2026-04-16T04:40:59.018096739Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:0402-1","title":"Security update for qt6-webengine","description":"This update for qt6-webengine fixes the following issues:\n\n- CVE-2024-11403: Fixed out of bounds memory read/write in libjxl (boo#1233764)\n","status":"published","published":"2024-12-09T17:02:08Z","modified":"2026-02-04T03:29:31.955351Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:14531-1","title":"libjxl-devel-0.11.1-1.1 on GA media","description":"These are all security issues fixed in the libjxl-devel-0.11.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-27T00:00:00Z","modified":"2026-02-04T02:57:28.404537Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14594-1","title":"libmozjs-115-0-115.15.0-4.1 on GA media","description":"These are all security issues fixed in the libmozjs-115-0-115.15.0-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-17T00:00:00Z","modified":"2026-02-04T03:53:34.89546Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14600-1","title":"libmozjs-128-0-128.5.1-3.1 on GA media","description":"These are all security issues fixed in the libmozjs-128-0-128.5.1-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-18T00:00:00Z","modified":"2026-02-04T03:23:45.491039Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:0139-1","title":"Security update for libjxl","description":"This update for libjxl fixes the following issues:\n\n- Update to release 0.8.4\n  * Huffman lookup table size fix [CVE-2024-11403]\n  * Check height limit in modular trees [CVE-2024-11498]\n","status":"published","published":"2025-04-30T12:01:35Z","modified":"2026-02-04T03:59:53.754285Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2024:4411-1","title":"Security update for mozjs115","description":"This update for mozjs115 fixes the following issues:\n\n- CVE-2024-11498: Fixed resource exhaustion via Stack overflow in libjxl (bsc#1233786)\n- CVE-2024-11403: Fixed out of Bounds Memory Read/Write in libjxl (bsc#1233766)\n- CVE-2024-50602: Fixed DoS via XML_ResumeParser in libexpat (bsc#1232602)\n","status":"published","published":"2024-12-23T12:45:58Z","modified":"2026-02-04T03:53:40.814623Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01883-1","title":"Security update for libjxl","description":"This update for libjxl fixes the following issues:\n\n- CVE-2024-11403: Fix out of bounds memory read/write in libjxl (bsc#1233768).\n","status":"published","published":"2025-06-11T05:42:29Z","modified":"2026-02-04T02:52:21.770779Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"USN-7637-1","title":"jpeg-xl vulnerabilities","description":"It was discovered that libjxl did not perform proper bounds checking\nwhen parsing Exif tags. An attacker could possibly use this issue to\ncause libjxl to crash, resulting in a denial of service. (CVE-2023-0645)\n\nIt was discovered that libjxl did not perform proper bounds checking \nwhen decoding patches. An attacker could possibly use this issue to\ncause libjxl to enter an infinite loop, resulting in a denial of \nservice. (CVE-2023-35790)\n\nIt was discovered that libjxl did not perform proper bounds checking\nwhen performing JPEG recompression. An attacker could possibly use this\nissue to cause libjxl to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2024-11403)\n\nIt was discovered that libjxl incorrectly handled parsing certain image\nfiles. An attacker could possibly use this issue to cause libjxl to \nconsume excessive amounts of memory, resulting in a denial of service.\n(CVE-2024-11498)","status":"published","published":"2025-07-14T16:31:56Z","modified":"2026-04-22T11:00:54.50932Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}