PT-2024-18937 · Images · Images

Alessio Della Libera · Published 2024-07-10 · Updated 2024-08-01 · CVE-2024-21523

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions package images (affected versions not specified)

Description The issue is related to providing unexpected input types to several different functions, which can lead to a process crash due to reaching an assert macro. Specifically, providing certain integer values, such as 0, to the size function can result in a Segmentation fault error, causing the process to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-241

Related Identifiers

CVE-2024-21523

GHSA-VJPV-X8P9-7P85

Affected Products

Images

References · 11

• https://osv.dev/vulnerability/CVE-2024-21523 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21523 · Security Note
• https://osv.dev/vulnerability/GHSA-vjpv-x8p9-7p85 · Vendor Advisory
• https://github.com/zhangyuanwei/node-images/blob/691d49f4e620b4eec9f1c47b1735841d9d8b55f6/src/Image.cc · Note
• https://github.com/zhangyuanwei/node-images · Note
• https://twitter.com/VulmonFeeds/status/1811002772159930422 · Twitter Post
• https://gist.github.com/dellalibera/8b4ea6b4db84cba212e6e6e39a6933d1 · Note
• https://t.me/cvedetector/511 · Telegram Post
• https://security.snyk.io/vuln/SNYK-JS-IMAGES-6421826 · Note
• https://t.me/cvenotify/85656 · Telegram Post
• https://twitter.com/CVEnew/status/1810944911291863257 · Twitter Post