CVE-2024-32036
SixLabors.ImageSharp vulnerable to data leakage
Summary
SixLabors.ImageSharp vulnerable to data leakage
Original description
The description as published by the source.
ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer. The problem has been patched in v3.1.4 and v2.1.8.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
NuGet
SixLabors.ImageSharp
[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}]
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- patch github.com