ImageSharp is a managed, cross-platform, 2D graphics library. A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure. This issue has been patched in versions 3.1.3 and 2.1.7.
CVE-2024-27929 - High Severity Vulnerability
A new, fully featured, fully managed, cross-platform, 2D graphics API for .NET
Library home page: https://api.nuget.org/packages/sixlabors.imagesharp.2.1.3.nupkg
Path to dependency file: /bolzplatzarena.blog.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/sixlabors.imagesharp/2.1.3/sixlabors.imagesharp.2.1.3.nupkg
Dependency Hierarchy: - piranha.imagesharp.10.4.0.nupkg (Root Library) - :x: **sixlabors.imagesharp.2.1.3.nupkg** (Vulnerable Library)
Found in HEAD commit: dfdf3c8036bf586f4825d703adbbb7ae84375391
Found in base branch: develop
ImageSharp is a managed, cross-platform, 2D graphics library. A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure. This issue has been patched in versions 3.1.3 and 2.1.7.
Publish Date: 2024-03-05
URL: CVE-2024-27929
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-65x7-c272-7g7r
Release Date: 2024-03-05
Fix Resolution: SixLabors.ImageSharp - 2.1.7,3.1.3
Step up your Open Source Security Game with Mend here