Vulnerabilities

 4 via 4 paths

Dependencies

 100

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 2
  • 2
Status
  • 4
  • 0
  • 0

high severity
new

Heap-based Buffer Overflow

  • Vulnerable module: sharp
  • Introduced through: sharp@0.33.5

Detailed paths

  • Introduced through: @master4n/master-cli@Master4Novice/master-cli › sharp@0.33.5
    Remediation: Upgrade to sharp@0.35.0.

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the bundled libvips TIFF loader (VipsForeignLoadTiff), which can miscount the channels of a tile encoded as JPEG or JPEG2000 within a TIFF image. An attacker can corrupt heap memory and crash the process, with a possibility of code execution, by supplying a TIFF whose JPEG or JPEG2000 tiles cause the channel count to be misdetermined and the buffer undersized. Exploitation requires the application to decode an untrusted TIFF with JPEG or JPEG2000 tiles through sharp.

Workaround

This vulnerability can be avoided by blocking the TIFF loader through sharp's block() for the VipsForeignLoadTiff operation, or by setting the VIPS_BLOCK_UNTRUSTED environment variable, so untrusted TIFF images are not decoded.

Remediation

Upgrade sharp to version 0.35.0 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity
new

Integer Overflow

  • Vulnerable module: sharp
  • Introduced through: sharp@0.33.5

Detailed paths

  • Introduced through: @master4n/master-cli@Master4Novice/master-cli › sharp@0.33.5
    Remediation: Upgrade to sharp@0.35.0.

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Integer Overflow leading to a heap buffer overflow in the bundled libvips VIPS loader (VipsForeignLoadVips), which can miscompute image dimensions. An attacker can corrupt heap memory and crash the process, with a possibility of code execution, by supplying a VIPS (.vips) image whose dimensions overflow the size calculation. Exploitation requires the application to decode an untrusted VIPS image through sharp.

Workaround

This vulnerability can be avoided by blocking the VIPS loader through sharp's block() for the VipsForeignLoadVips operation, or by setting the VIPS_BLOCK_UNTRUSTED environment variable, so untrusted VIPS images are not decoded.

Remediation

Upgrade sharp to version 0.35.0 or higher.

References

Integer Overflow vulnerability report

medium severity
new

Integer Overflow

  • Vulnerable module: sharp
  • Introduced through: sharp@0.33.5

Detailed paths

  • Introduced through: @master4n/master-cli@Master4Novice/master-cli › sharp@0.33.5
    Remediation: Upgrade to sharp@0.35.0.

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Integer Overflow in the bundled libvips GIF loader (VipsForeignLoadNsgif), which can miscompute image dimensions on 32-bit systems. An attacker can crash the process by supplying a GIF whose dimensions overflow the size calculation. Exploitation affects only 32-bit systems and requires the application to decode an untrusted GIF through sharp.

Workaround

This vulnerability can be avoided by blocking the GIF loader through sharp's block() for the VipsForeignLoadNsgif operation, or by setting the VIPS_BLOCK_UNTRUSTED environment variable, so untrusted GIF images are not decoded.

Remediation

Upgrade sharp to version 0.35.0 or higher.

References

Integer Overflow vulnerability report

medium severity
new

Out-of-bounds Read

  • Vulnerable module: sharp
  • Introduced through: sharp@0.33.5

Detailed paths

  • Introduced through: @master4n/master-cli@Master4Novice/master-cli › sharp@0.33.5
    Remediation: Upgrade to sharp@0.35.0.

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Out-of-bounds Read and null pointer dereference in the bundled libvips EXIF decoder, which does not validate the range of EXIF tag groups before passing them to libexif. An attacker can crash the process by supplying an image whose embedded EXIF metadata carries an out-of-range tag group. Exploitation requires the application to process an untrusted image whose EXIF metadata sharp reads.

Remediation

Upgrade sharp to version 0.35.0 or higher.

References

Out-of-bounds Read vulnerability report