LOW

GHSA-q7pp-wcgr-pffx

Crash when processing crafted TIFF files

Details

Disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a crafted TIFF file to the scan function of scanner.go. NOTE: it is unclear whether there are common use cases in which this panic could have any security consequence

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/disintegration/imaging

Introduced in: 0

No fixed version published yet for github.com/disintegration/imaging (go modules). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-36308[ADVISORY]
https://github.com/disintegration/imaging/issues/165[WEB]
https://github.com/disintegration/imaging/releases/tag/v1.6.2[WEB]
github.com/disintegration/imaging[PACKAGE]