Fluid Attacks Database

Description

SixLabors ImageSharp Out-of-bounds Write

Impact

An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service.

Patches

The problem has been patched. All users are advised to upgrade to v3.1.5 or v2.1.9.

Workarounds

None.

References

https://github.com/SixLabors/ImageSharp/pull/2754 https://github.com/SixLabors/ImageSharp/pull/2756

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
nuget	sixlabors.imagesharp	>=0 <2.1.9 \|\| >=3.0.0 <3.1.5	2.1.9, 3.1.5

Aliases

1. CVE-2024-411312. NVD-2024-411313. OSV-2024-411314. GHSA-63p8-c4ww-9cg75. GCVE-2024-41131

References

1. https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-63p8-c4ww-9cg72. https://github.com/SixLabors/ImageSharp/pull/27543. https://github.com/SixLabors/ImageSharp/pull/27564. https://github.com/SixLabors/ImageSharp/commit/9dda64a8186af67baf06b6d9c1ab599c3608b6935. https://github.com/SixLabors/ImageSharp/commit/a1f287977139109a987065643b8172c748abdadb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.