HIGH7.5

GHSA-2cmq-823j-5qj8

Out-of-bounds Write in SixLabors ImageSharp

Quick fix

GHSA-2cmq-823j-5qj8 — SixLabors.ImageSharp: upgrade to the fixed version with the command below.

dotnet add package SixLabors.ImageSharp --version 3.1.7

Details

### Impact An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service.

### Patches The problem has been patched. All users are advised to upgrade to v3.1.7 or v2.1.10.

### Workarounds None.

### References https://github.com/SixLabors/ImageSharp/issues/2859 https://github.com/SixLabors/ImageSharp/issues/2890

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/SixLabors.ImageSharp

Introduced in: 3.0.0Fixed in: 3.1.7

Fixdotnet add package SixLabors.ImageSharp --version 3.1.7

NuGet/SixLabors.ImageSharp

Introduced in: 0Fixed in: 2.1.10

Fixdotnet add package SixLabors.ImageSharp --version 2.1.10