Headline
GHSA-65x7-c272-7g7r: Use After Free in SixLabors.ImageSharp
Impact
A heap-use-after-free flaw was found in ImageSharp’s InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure.
Patches
The problem has been patched. All users are advised to upgrade to v3.1.3
Workarounds
None
References
None
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-27929
Use After Free in SixLabors.ImageSharp
High severity GitHub Reviewed Published Mar 5, 2024 in SixLabors/ImageSharp • Updated Mar 5, 2024
Package
nuget SixLabors.ImageSharp (NuGet)
Affected versions
< 3.1.3
Impact
A heap-use-after-free flaw was found in ImageSharp’s InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure.
Patches
The problem has been patched. All users are advised to upgrade to v3.1.3
Workarounds
None
References
None
References
- GHSA-65x7-c272-7g7r
Published to the GitHub Advisory Database
Mar 5, 2024