Package: jxrlib > Version: 1.2~git20170615.f752187-5.3 > Severity: important > Tags: security upstream > X-Debbugs-Cc: [email protected] > > Hello, > > jxrlib in Debian (1.2~git20170615.f752187-5.3 in sid, forky and trixie; -5 in > bookworm; 1.1-6 in > bullseye) has memory bugs that a damaged JPEG XR file of a few hundred bytes > triggers, including a > heap buffer overflow write. All of them are fixed in the maintained fork > https://github.com/mircomir/jxrlib (1.4.4, 2026-10-09), which Arch, openSUSE > Tumbleweed and > MacPorts already ship. > > Details, the affected functions and the fixing commits: > https://www.openwall.com/lists/oss-security/2026/10/24/1 > > In short (line numbers from 1.2~git20170615.f752187-5.3): > > 1. ReadBinaryData, jxrgluelib/JXRMeta.c:677: uCount + 2 overflows, heap > buffer overflow > (write). Shown by source review. Fixed in cb97e6d. > 2. ReadWMIHeader, image/decode/strdec.c:2965: stack buffer over-read. Fixed > in d6e5f8d. > 3. DecodeSignificantRun, image/decode/segdec.c:362: global buffer over-read. > Fixed in debe47a. > 4. initLookupTables, image/decode/strdec.c:2617: global buffer over-read. > Fixed in ba86c04. > 5. ImageStrDecDecode, image/decode/strdec.c:3536: NULL write, crash. Fixed in > 190078d. > 6. ParsePFDEntry, jxrgluelib/JXRGlueJxr.c:1573: assert, builds with asserts > only. Fixed in 7d2d462. > > Items 2 to 5 reproduce under AddressSanitizer with JxrDecApp built from > Debian's source > package. The security team has the test files; I can attach them here too if > that helps. > > Suggested fix: move to mircomir/jxrlib 1.4.4, or backport the six commits. > > Best regards > Joachim Ruetter > https://featherview.mynetx.net
