GitHub Advisoryadvisory · NuGet
GHSA-63p8-c4ww-9cg7 SixLabors ImageSharp Out-of-bounds Write
HIGH
Official page ↗
- Aliases
- CVE-2024-41131
- Ecosystem
- NuGet
- Packages
- SixLabors.ImageSharp
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-787
- Reviewed
- 2024-07-22
Affected packages
• NuGet SixLabors.ImageSharp: < 2.1.9 → fixed in 2.1.9
• NuGet SixLabors.ImageSharp: >= 3.0.0, < 3.1.5 → fixed in 3.1.5
Description
Impact
An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service.
Patches
The problem has been patched. All users are advised to upgrade to v3.1.5 or v2.1.9.
Workarounds
None.
References
https://github.com/SixLabors/ImageSharp/pull/2754
https://github.com/SixLabors/ImageSharp/pull/2756
Related
Alias · CVE (1)
- CVE-2024-41131 ImageSharp is a 2D graphics API. vulnerability
Weakness · CWE (1)
- CWE-787 Out-of-bounds Write weakness
References
- https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-63p8-c4ww-9cg7 web
- https://nvd.nist.gov/vuln/detail/CVE-2024-41131 advisory
- https://github.com/SixLabors/ImageSharp/pull/2754 web
- https://github.com/SixLabors/ImageSharp/pull/2756 web
- https://github.com/SixLabors/ImageSharp/commit/9dda64a8186af67baf06b6d9c1ab599c3608b693 web
- https://github.com/SixLabors/ImageSharp/commit/a1f287977139109a987065643b8172c748abdadb web
- https://github.com/SixLabors/ImageSharp package