What is GHSA-65x7-c272-7g7r?

GHSA-65x7-c272-7g7r is a security advisory published by GitHub Security Advisories with High severity. Use After Free in SixLabors.ImageSharp

Which CVE IDs does GHSA-65x7-c272-7g7r cover?

GHSA-65x7-c272-7g7r covers the following CVE IDs: CVE-2024-27929. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-65x7-c272-7g7r?

GHSA-65x7-c272-7g7r has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

Which products are affected by GHSA-65x7-c272-7g7r?

GHSA-65x7-c272-7g7r affects 2 products, including: nuget/SixLabors.ImageSharp:\u003e= 3.0.0, \u003c 3.1.3; nuget/SixLabors.ImageSharp:\u003c 2.1.7.

GHSA-65x7-c272-7g7rHighCVSS 7.1

Use After Free in SixLabors.ImageSharp

Vendor

GitHub Security Advisories

Published

March 5, 2024

Last Modified

March 6, 2024

🔗 CVE IDs covered (1)

CVE-2024-27929 →

📋 Description

Impact

A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure.

Patches

The problem has been patched. All users are advised to upgrade to v3.1.3 or v2.1.7.

Workarounds

None

References

None

🎯 Affected products2

nuget/SixLabors.ImageSharp:>= 3.0.0, < 3.1.3
nuget/SixLabors.ImageSharp:< 2.1.7

🔗 References (4)

https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-65x7-c272-7g7r
https://nvd.nist.gov/vuln/detail/CVE-2024-27929
https://github.com/SixLabors/ImageSharp/pull/2688
https://github.com/advisories/GHSA-65x7-c272-7g7r