MEDIUM 6.1
GHSA-82mp-vp5c-9pf7
ImageMagick: Policy Bypass in concatenate operation due to missing checks
Quick fix
GHSA-82mp-vp5c-9pf7 — Magick.NET-Q16-AnyCPU: upgrade to the fixed version with the command below.
dotnet add package Magick.NET-Q16-AnyCPU --version 14.15.0Details
The `-concatenate` operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
Are you affected?
Enter the version of the package you're using.
Affected packages
NuGet / Magick.NET-Q16-AnyCPU
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q16-AnyCPU --version 14.15.0 NuGet / Magick.NET-Q16-HDRI-AnyCPU
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.15.0 NuGet / Magick.NET-Q16-HDRI-OpenMP-arm64
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.15.0 NuGet / Magick.NET-Q16-HDRI-x64
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.15.0 NuGet / Magick.NET-Q16-HDRI-x86
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.15.0 NuGet / Magick.NET-Q16-OpenMP-arm64
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.15.0 NuGet / Magick.NET-Q16-OpenMP-x64
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.15.0 NuGet / Magick.NET-Q16-arm64
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q16-arm64 --version 14.15.0 NuGet / Magick.NET-Q16-x64
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q16-x64 --version 14.15.0 NuGet / Magick.NET-Q16-x86
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q16-x86 --version 14.15.0 NuGet / Magick.NET-Q8-AnyCPU
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q8-AnyCPU --version 14.15.0 NuGet / Magick.NET-Q8-OpenMP-arm64
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.15.0 NuGet / Magick.NET-Q8-OpenMP-x64
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.15.0 NuGet / Magick.NET-Q8-arm64
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q8-arm64 --version 14.15.0 NuGet / Magick.NET-Q8-x64
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q8-x64 --version 14.15.0 NuGet / Magick.NET-Q8-x86
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q8-x86 --version 14.15.0 NuGet / Magick.NET-Q16-HDRI-arm64
Introduced in:
0 Fixed in: 14.15.0 Fix
dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.15.0