GHSA-65x7-c272-7g7r

Source

https://github.com/advisories/GHSA-65x7-c272-7g7r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-65x7-c272-7g7r/GHSA-65x7-c272-7g7r.json

Aliases

• CVE-2024-27929

Published

2024-03-05T16:26:15Z

Modified

2024-03-06T22:02:45.926986Z

Details

Impact

A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure.

Patches

The problem has been patched. All users are advised to upgrade to v3.1.3 or v2.1.7.

Workarounds

None

References

None

References

• https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-65x7-c272-7g7r
• https://nvd.nist.gov/vuln/detail/CVE-2024-27929
• https://github.com/SixLabors/ImageSharp/pull/2688
• https://github.com/SixLabors/ImageSharp