CVE-2024-46993 Electron Vulnerable to Heap Buffer Overflow in NativeImage::CreateFromPath

Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 28.3.2, 29.3.3, and 30.0.3, the nativeImage.createFromPath and nativeImage.createFromBuffer functions call a function downstream that is vulnerable to a heap...

CVE-2024-46993

CVE-2024-46993 : In Electron, the nativeImage.createFromPath() and nativeImage.createFromBuffer() functions are vulnerable to a heap-based buffer overflow when processing image data whose height, width, or contents are controlled by an attacker. Affected releases include Electron versions prior t...

@finsemble/finsemble-core (>=8.11.0-beta.1, <=10.0.0-iocd-6), @finsemble/finsemble-electron-adapter (>=8.11.0-beta.1, <=10.0.0-iocd-6) +7 more potentially affected by CVE-2024-46993 via electron (>=29.0.1, <=29.3.1)

electron NPM version =29.0.1, =8.11.0-beta.1, =8.11.0-beta.1, =0.0.168-dev, =0.0.40, =2.0.125, =2024.4.146, =6.10.4, =10.0.53 Source cves: CVE-2024-46993 Source advisory: OSV:GHSA-6R2X-8PQ8-9489...

@kumologica/kumologica-contrib-amazonbedrock (0.0.1-beta), @kumologica/sdk (>=3.6.0-alpha10, <=4.0.1) +2 more potentially affected by CVE-2024-46993 via electron (>=30.0.0, <=30.0.2)

electron NPM version =30.0.0, =3.6.0-alpha10, =2.0.131, =0.1.1, =0.1.3 Source cves: CVE-2024-46993 Source advisory: OSV:GHSA-6R2X-8PQ8-9489...

@codeceptjs/ui (0.7.7), @epicdm/flowstate-shell (>=1.0.1, <=1.0.8) +7 more potentially affected by CVE-2024-46993 via electron (>=28.0.0, <=28.2.3)

electron NPM version =28.0.0, =1.0.1, =9.2.0, =2.0.119, =0.62.0, =0.79.19 - yt-play-cli 0.14.0 Source cves: CVE-2024-46993 Source advisory: OSV:GHSA-6R2X-8PQ8-9489...