Ubuntu alert USN-8397-1 (jpeg-xl)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8397-1] libjxl vulnerability
Date:
             
 
Mon, 08 Jun 2026 13:27:16 +0000
Message-ID:
             
 
<E1wWa0a-0006iU-0M@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8397-1
June 08, 2026

jpeg-xl vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 25.10

Summary:

libjxl could be made to crash or run programs if it opened a specially
crafted file.

Software Description:
- jpeg-xl: Reference codec implementation for JPEG XL compressed raster image format

Details:

It was discovered that libjxl did not properly handle certain crafted PBM
images. An attacker could possibly use this issue to cause libjxl to crash,
resulting in a denial of service, or execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  libjxl-tools                    0.11.1-6ubuntu4.2
  libjxl0.11                      0.11.1-6ubuntu4.2

Ubuntu 25.10
  libjxl-tools                    0.11.1-6ubuntu1.2
  libjxl0.11                      0.11.1-6ubuntu1.2

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8397-1
  CVE-2025-70103

Package Information:
  https://launchpad.net/ubuntu/+source/jpeg-xl/0.11.1-6ubun...
  https://launchpad.net/ubuntu/+source/jpeg-xl/0.11.1-6ubun...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmomwnwACgkQcpJm3tlz
hgGYJQ//YcGfeGoiHwe09j1qVsPpW1w0sxeXT30LfNuInbRmMf4WRlXuPILUUmWl
6O4xsx/7VO2PT0/f5ic91RV4GcpBYZ53n2gLns+F/adHJcZlTp/MvjkNnDDRng/B
JncnO/xUj4UXHR+0JRH+u0NE+8JJmQAZfQfM5N/uBDZ4mEZ5de3JmbukXTEUSpMX
gN/VEqSDpaDPtkCiJ4HnHRb0tczvt0Gv7xNNIy1ZPXuuY4btkt3K73ka+hD3c8xH
dWyjRHeykIayDC5fSK8iK6G08aU97OMiyZ+i0DrO/gRFQlcxKJLy05Li+nMvW8rc
YfqZCoNdMvUgu2VSG9NQHOlKFWY/i5HEkXu/cryuKNXLVYaVKWu7KNDRkFpJKkc2
zj6O53TX4h1OaXtx9lXp45W9qrcQ5SivMIxY5TSYy8yIvkwg9hOftaW8bbA5/JYZ
Sav7Xuf6zvuTKpG2lqnxnzhfTLNhKNntD9HNkXd1ztaNMT1w81+jHMagPbWGqNvC
wnnlgggPrEJjj6QPOjMQ/BXHfEeFGZgxu6V5ATSXROaAwT3puJcV9Gtb1Xv9n1Lr
s1MqsjA+Zj385uqLS4VFeC7VVxaWVeiqb6xYBTn4mIm/fn5l8vnX5kMYnLGCxnK1
TQmclWAwlphOFGg2xyNyEzN6Dya9nU+zEupuJrk+OgfdTwmcwMQ=
=iO/t
-----END PGP SIGNATURE-----