VDB
Sign up
HIGH7.1

GHSA-65x7-c272-7g7r

Use After Free in SixLabors.ImageSharp

Quick fix

GHSA-65x7-c272-7g7r — SixLabors.ImageSharp: upgrade to the fixed version with the command below.

dotnet add package SixLabors.ImageSharp --version 3.1.3

Details

### Impact A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure.

### Patches The problem has been patched. All users are advised to upgrade to v3.1.3 or v2.1.7.

### Workarounds None

### References None

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/SixLabors.ImageSharp
Introduced in: 3.0.0Fixed in: 3.1.3
Fixdotnet add package SixLabors.ImageSharp --version 3.1.3
NuGet/SixLabors.ImageSharp
Introduced in: 0Fixed in: 2.1.7
Fixdotnet add package SixLabors.ImageSharp --version 2.1.7

References