Detections
Analytics

Alpine: multiple libjxl packages: security update to 0.10.4-r0

medium Tenable Cloud Security Plugin ID 427283

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - There exists an out of bounds read/write in LibJXL versions prior to commit
 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG
 recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in
 the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released
 as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a
 bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue
 could however cause jpegli to read uninitialised memory, or addresses of functions. (CVE-2024-11403)

 - There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder
 to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the
 stack. An attacker can craft a file that will cause excessive memory usage. We recommend upgrading past
 commit 65fbec56bc578b6b6ee02a527be70787bbd053b0. (CVE-2024-11498)

See Also

https://security.alpinelinux.org/vuln/CVE-2024-11403

https://security.alpinelinux.org/vuln/CVE-2024-11498

Plugin Details

Severity: Medium

ID: 427283

Version: Revision 1.17

Type: Local

Published: 5/16/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 97.35

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-11403

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 3.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

CVSS Score Source: CVE-2024-11498

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 11/25/2024

Reference Information

CVE: CVE-2024-11403, CVE-2024-11498