jxrlib contains multiple memory safety vulnerabilities triggered by malformed JPEG XR files: (1) Heap buffer overflow write in ReadBinaryData due to integer overflow in metadata count allocation, (2) Stack buffer over-read in ReadWMIHeader from unterminated signature buffer passed to strstr, (3) Global buffer over-read in DecodeSignificantRun from unchecked run length indexing, (4) Global buffer over-read in initLookupTables from unchecked bit depth indexing, (5) NULL pointer write/crash in ImageStrDecDecode when memset called on unallocated row buffer, (6) Assertion failure in ParsePFDEntry on orientation tag. Impact includes denial of service crashes and potential information disclosure through buffer over-reads.
| Vendor | Product | Versions |
|---|---|---|
| microsoft | jxrlib | < 1.4.4, 1.1, 1.2~git20170615.f752187 |
Loading…
