Lucene search

GitHub_MVULNRICHMENT:CVE-2024-41132

HistoryJul 22, 2024 - 2:28 p.m.

CVE-2024-41132 SixLabors ImageSharp Allows Excessive Memory Allocation in Gif Decoder

2024-07-2214:28:25

CWE-789

GitHub_M

github.com

sixlabors imagesharp

vulnerability

gif decoder

memory allocation

cve-2024-41132

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

6.7

Confidence

Low

EPSS

0.003

Percentile

71.7%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. All users are advised to upgrade to v3.1.5 or v2.1.9.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*"
    ],
    "vendor": "sixlabors",
    "product": "imagesharp",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.1.9",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "3.0.0",
        "lessThan": "3.1.5",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands

docs.sixlabors.com/articles/imagesharp/security.html

github.com/SixLabors/ImageSharp/commit/59de13c8cc47f2b402e2c43aa7024511d029d515

github.com/SixLabors/ImageSharp/commit/9816ca45016c5d3859986f3c600e8934bc450a56

github.com/SixLabors/ImageSharp/commit/b496109051cc39feee1f6cde48fca6481de17f9a

github.com/SixLabors/ImageSharp/pull/2759

github.com/SixLabors/ImageSharp/pull/2764

github.com/SixLabors/ImageSharp/pull/2770

github.com/SixLabors/ImageSharp/security/advisories/GHSA-qxrv-gp6x-rc23

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

6.7

Confidence

Low

EPSS

0.003

Percentile

71.7%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-41132