GitHub Advisoryadvisory · NuGet

GHSA-65x7-c272-7g7r Use After Free in SixLabors.ImageSharp

HIGH Published 2024-03-05 Modified 2024-03-06 Official page ↗
Aliases
CVE-2024-27929
Ecosystem
NuGet
Packages
SixLabors.ImageSharp
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weaknesses
CWE-416
Reviewed
2024-03-05

Affected packages

• NuGet SixLabors.ImageSharp: >= 3.0.0, < 3.1.3 → fixed in 3.1.3 • NuGet SixLabors.ImageSharp: < 2.1.7 → fixed in 2.1.7

Description

Impact A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure. Patches The problem has been patched. All users are advised to upgrade to v3.1.3 or v2.1.7. Workarounds None References None

Related

Alias · CVE (1)

  • CVE-2024-27929 ImageSharp is a managed, cross-platform, 2D graphics library. vulnerability

Weakness · CWE (1)

References