GHSA-v8gq-5grq-9728 mozjpeg DecompressScanlines::read_scanlines is Unsound

Not scored Published 4 Jul 2020

Unsound memory handling in mozjpeg allows attackers to cause memory corruption or arbitrary code execution via crafted images.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-v8gq-5grq-9728?

GHSA-v8gq-5grq-9728 is a memory corruption vulnerability in mozjpeg, published on 4 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

This issue and vector is similar to RUSTSEC-2020-0029 of rgb crate which mozjpeg depends on.

Affected versions of mozjpeg crate allow creating instances of any type T from bytes, and do not correctly constrain T to the types for which it is safe to do so.

Examples of safety violation possible for a type T:

T contains a reference type, and it constructs a pointer to an invalid, arbitrary memory address.
T requires a safety and/or validity invariant for its construction that may be violated.

The issue was fixed in 0.8.19 by using safer types and involving rgb dependency bump.

Which versions are affected by GHSA-v8gq-5grq-9728?

3 open source packages ship an affected version, including mozjpeg.

Package	Affected	Fixed in
`mozjpeg` crates.io	All versions	`0.8.19`
`mozjpeg` crates.io	All versions	`0.8.19`
`mozjpeg` crates.io	From `0.0.0-0`	`0.8.19`

How do I fix GHSA-v8gq-5grq-9728?

Upgrade mozjpeg to 0.8.19 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is GHSA-v8gq-5grq-9728 being exploited?

There is no known exploitation of GHSA-v8gq-5grq-9728 in the wild and no public exploit code.

Sources

Also known as RUSTSEC-2020-0165.