GHSA-65x7-c272-7g7r
Use After Free in SixLabors.ImageSharp
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| NuGet | SixLabors.ImageSharp | >= 3.0.0, < 3.1.3 | 3.1.3 |
| NuGet | SixLabors.ImageSharp | < 2.1.7 | 2.1.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure.
### Patches
The problem has been patched. All users are advised to upgrade to v3.1.3 or v2.1.7.
### Workarounds
None
### References
None
References
External links from the advisory. They lead to third-party sites.