CVE-2024-41437

A heap buffer overflow in the cp_unfilter() function in hicolor v0.5.0 (located in /vendor/cute_png.h) can lead to Denial of Service via a crafted PNG file. Public sources consistently describe the affected component as hicolor v0.5.0 and identify the vulnerability as a heap overflow in cp_unfilt...

CVE-2024-41438

A heap buffer overflow in the function cpstored /vendor/cutepng.h of hicolor v0.5.0 allows attackers to cause a Denial of Service DoS via a crafted PNG file...

CVE-2024-41439

A heap buffer overflow in the function cpblock /vendor/cutepng.h of hicolor v0.5.0 allows attackers to cause a Denial of Service DoS via a crafted PNG file...

PT-2024-29399 · Hicolor · Hicolor

Name of the Vulnerable Software and Affected Versions: hicolor version 0.5.0 Description: A heap buffer overflow in the function cp stored /vendor/cute png.h allows attackers to cause a Denial of Service DoS via a crafted PNG file. This issue also risks crashes, data corruption, and potentially...

CVE-2024-41438

A heap buffer overflow in the function cpstored /vendor/cutepng.h of hicolor v0.5.0 allows attackers to cause a Denial of Service DoS via a crafted PNG file...

HiColor 安全漏洞

HiColor is a program by the individual developer D. Bohdan. It is used to convert images to 15-bit and 16-bit RGB colors. A security vulnerability exists in HiColor version 0.5.0, which stems from a heap buffer overflow vulnerability in the cpunfilter function, allowing an attacker to trigger a...

CVE-2024-41439

A heap buffer overflow in the function cpblock /vendor/cutepng.h of hicolor v0.5.0 allows attackers to cause a Denial of Service DoS via a crafted PNG file...

CVE-2024-41437

A heap buffer overflow in the function cpunfilter /vendor/cutepng.h of hicolor v0.5.0 allows attackers to cause a Denial of Service DoS via a crafted PNG file...

CVE-2024-41438

A heap buffer overflow in the function cpstored /vendor/cutepng.h of hicolor v0.5.0 allows attackers to cause a Denial of Service DoS via a crafted PNG file...

CVE-2024-41439

A heap buffer overflow in the function cpblock /vendor/cutepng.h of hicolor v0.5.0 allows attackers to cause a Denial of Service DoS via a crafted PNG file...

PT-2024-29400 · Hicolor · Hicolor

Name of the Vulnerable Software and Affected Versions: hicolor version 0.5.0 Description: A heap buffer overflow in the cp block function, located in /vendor/cute png.h, allows attackers to cause a Denial of Service DoS via a crafted PNG file. Recommendations: For hicolor version 0.5.0, consider...

PT-2024-29398 · Hicolor · Hicolor

Name of the Vulnerable Software and Affected Versions: hicolor version 0.5.0 Description: A heap buffer overflow in the cp unfilter function, located in /vendor/cute png.h, allows attackers to cause a Denial of Service DoS via a crafted PNG file. Recommendations: For hicolor version 0.5.0, consid...

CVE-2024-41440

A heap buffer overflow in the function pngquantize of hicolor v0.5.0 allows attackers to cause a Denial of Service DoS via a crafted PNG file...

CVE-2024-41439

CVE-2024-41439 – hicolor v0.5.0 is affected by a heap buffer overflow in the function cp_block() (in /vendor/cute_png.h), enabling a Denial of Service via a crafted PNG file. The vulnerability arises from cp_block() handling that can overflow heap memory. A PoC exists (per references) and may be ...

CVE-2024-41438

The CVE-2024-41438 issue affects hicolor v0.5.0, with a heap buffer overflow in cp_stored() implemented in /vendor/cute_png.h that enables DoS via a crafted PNG file. Multiple trusted sources corroborate the vulnerability and indicate the exposure is tied to hicolor 0.5.0. Root cause is a heap ov...

CVE-2024-41443

A stack overflow in the function cpdynamic /vendor/cutepng.h of hicolor v0.5.0 allows attackers to cause a Denial of Service DoS via a crafted PNG file...

Information Disclosure

@jmondi/url-to-png is vulnerable to Information Disclosure. The vulnerability is caused due to a lack of a blocklist mechanism to restrict which URLs can be captured as screenshots. This allows an attacker to potentially capture screenshots of sensitive information from local web services...

CVE-2024-39918

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the ImageId in the code is not sanitized and may lead to path traversal. This allows an attacker to store an image in ...

CVE-2024-39919

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. The package includes an ALLOWLIST where the host can specify which services the user is permitted to capture screenshots of. By...

CVE-2024-39919 Capture screenshot of localhost web services (unauthenticated pages) in @jmondi/url-to-png

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. The package includes an ALLOWLIST where the host can specify which services the user is permitted to capture screenshots of. By...