Lucene search

GitHub Advisory DatabaseGHSA-9PHM-FM57-RHG8

HistoryJun 26, 2024 - 7:26 p.m.

Panic when parsing invalid palette-color images in golang.org/x/image

2024-06-2619:26:38

CWE-248

GitHub Advisory Database

github.com

parsing

palette-color

images

golang

malicious

color indices

panic

software

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

Parsing a corrupt or malicious image with invalid color indices can cause a panic.

Affected configurations

Vulners

Node

image-rsimageRange<0.18.0

CPENameOperatorVersion
golang.org/x/imagelt0.18.0

CPE	Name	Operator	Version
	golang.org/x/image	lt	0.18.0

github.com/advisories/GHSA-9phm-fm57-rhg8

go.dev/cl/588115

go.dev/issue/67624

nvd.nist.gov/vuln/detail/CVE-2024-24792

pkg.go.dev/vuln/GO-2024-2937