CVE-2021-36692 Denial of service in n/a
An attacker can cause a denial of service by providing a malicious APNG file to the libjxl library during encoding.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-36692?
CVE-2021-36692 is a medium-severity denial of service vulnerability in n/a, published on 30 Aug 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
libjxl v0.3.7 is affected by a Divide By Zero in issue in lib/extras/codec_apng.cc jxl::DecodeImageAPNG(). When encoding a malicous APNG file using cjxl, an attacker can trigger a denial of service.
Weakness: CWE-369
Which versions are affected by CVE-2021-36692?
It affects 1 product.
Products include Libjxl Project Libjxl.
How do I fix CVE-2021-36692?
No fix has been published for CVE-2021-36692 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-36692 being exploited?
There is no known exploitation of CVE-2021-36692 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-g7qh-xf59-6jc7.