Description
ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the full expected block from a buffer obtained through Configuration.Default, allowing bytes retained from a completed prior ImageSharp operation to appear in decoded pixels. Applications that expose pixels or output from the later attacker-controlled EXR decode can disclose process-local image data. This issue is fixed in version 4.1.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
SixLabors ImageSharp
>= 4.0.0, < 4.1.2affected
References
- https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-4q3p-rj5x-xv7p ↗
- https://github.com/SixLabors/ImageSharp/pull/3187 ↗
- https://github.com/SixLabors/ImageSharp/commit/3c43cf583fdd98eff0f451397affaa31c6a2e6b1 ↗
- https://github.com/SixLabors/ImageSharp/commit/6ed2a275217d39301e76df42acec2a9533b39d2b ↗
- https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2 ↗