Inadequate file size control In golang.org/x/image
Description
Golang TIFF decoder does not place a limit on the size of compressed tile data The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 go | 0.10.0 | ||
 debian 12 | - | ||
debian 13 | 0.11.0-1 | ||
debian 14 | 0.11.0-1 | ||
go | 0.10.0 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4. 5. 6. 7.