PT-2024-29285 · Unknown · Imagesharp

Erik-White · Published 2024-07-22 · Updated 2024-09-11 · CVE-2024-41131

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ImageSharp versions prior to 2.1.9 ImageSharp versions prior to 3.1.5

Description An Out-of-bounds Write issue has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service.

Recommendations For versions prior to 2.1.9, upgrade to v2.1.9. For versions prior to 3.1.5, upgrade to v3.1.5.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2024-41131

GHSA-63P8-C4WW-9CG7

Affected Products

Imagesharp

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41131.json · Exploit
• https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-63p8-c4ww-9cg7 · Vendor Advisory
• https://github.com/SixLabors/ImageSharp/commit/a1f287977139109a987065643b8172c748abdadb · Patch
• https://github.com/SixLabors/ImageSharp/commit/9dda64a8186af67baf06b6d9c1ab599c3608b693 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-41131 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41131 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-63p8-c4ww-9cg7 · Vendor Advisory
• https://github.com/SixLabors/ImageSharp · Note
• https://github.com/SixLabors/ImageSharp/pull/2754 · Note
• https://github.com/SixLabors/ImageSharp/pull/2756 · Note
• https://t.me/cvenotify/87047 · Telegram Post
• https://t.me/cvenotify/94172 · Telegram Post