diff --git a/advisories/github-reviewed/2024/03/GHSA-65x7-c272-7g7r/GHSA-65x7-c272-7g7r.json b/advisories/github-reviewed/2024/03/GHSA-65x7-c272-7g7r/GHSA-65x7-c272-7g7r.json index 46662b09177..4a39d64aaff 100644 --- a/advisories/github-reviewed/2024/03/GHSA-65x7-c272-7g7r/GHSA-65x7-c272-7g7r.json +++ b/advisories/github-reviewed/2024/03/GHSA-65x7-c272-7g7r/GHSA-65x7-c272-7g7r.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-65x7-c272-7g7r", - "modified": "2024-03-05T20:29:57Z", + "modified": "2024-03-06T21:57:21Z", "published": "2024-03-05T16:26:15Z", "aliases": [ "CVE-2024-27929" ], "summary": "Use After Free in SixLabors.ImageSharp", - "details": "### Impact\nA heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure.\n\n### Patches\nThe problem has been patched. All users are advised to upgrade to v3.1.3\n\n### Workarounds\nNone\n\n### References\nNone", + "details": "### Impact\nA heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure.\n\n### Patches\nThe problem has been patched. All users are advised to upgrade to v3.1.3 or v2.1.7.\n\n### Workarounds\nNone\n\n### References\nNone\n", "severity": [ { "type": "CVSS_V3", @@ -25,7 +25,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "3.0.0" }, { "fixed": "3.1.3" @@ -33,6 +33,25 @@ ] } ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "SixLabors.ImageSharp" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.7" + } + ] + } + ] } ], "references": [ @@ -44,6 +63,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27929" }, + { + "type": "WEB", + "url": "https://github.com/SixLabors/ImageSharp/pull/2688" + }, { "type": "PACKAGE", "url": "https://github.com/SixLabors/ImageSharp"