OSV-2021-1055.yaml

id: OSV-2021-1055
summary: UNKNOWN WRITE in jxl::ModularFrameDecoder::DecodeGroup
details: |
  OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36456

  ```
  Crash type: UNKNOWN WRITE
  Crash state:
  jxl::ModularFrameDecoder::DecodeGroup
  jxl::FrameDecoder::ProcessACGroup
  jxl::ThreadPool::RunCallState<jxl::FrameDecoder::ProcessSections
  ```
modified: '2023-02-24T02:01:14.670136Z'
published: '2021-07-25T00:00:32.621715Z'
references:
- type: REPORT
  url: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36456
affected:
- package:
    name: libvips
    ecosystem: OSS-Fuzz
  ranges:
  - type: GIT
    repo: /~https://github.com/libvips/libvips
    events:
    - introduced: 813a5f84cf94c9e7c0fe9b043c545500aef11411
    - fixed: 86466a9b9ab37c0f469d84797d477260aa669cfa
    - fixed: 728f2e29053d03ad5d82b4bbfbc1ca91f24e7cf6
  versions:
  - v8.11
  - v8.11.0
  - v8.11.0-rc1
  - v8.11.1
  - v8.11.2
  - v8.11.3
  - v8.11.4
  ecosystem_specific:
    severity: HIGH
  database_specific:
    fixed_range: 86466a9b9ab37c0f469d84797d477260aa669cfa:728f2e29053d03ad5d82b4bbfbc1ca91f24e7cf6