TheRealBarenziah/waifu-generator:package.json
Find, fix and prevent vulnerabilities in your code.
critical severity
- Vulnerable module: sharp
- Introduced through: sharp@0.30.7
Detailed paths
-
Introduced through: waifu-generator@TheRealBarenziah/waifu-generator#f9ac502a4b698badff2a680276bf94bb6fa1b935 › sharp@0.30.7Remediation: Upgrade to sharp@0.32.6.
Overview
sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images
Affected versions of this package are vulnerable to Heap-based Buffer Overflow when the ReadHuffmanCodes() function is used. An attacker can craft a special WebP lossless file that triggers the ReadHuffmanCodes() function to allocate the HuffmanCode buffer with a size that comes from an array of precomputed sizes: kTableSize. The color_cache_bits value defines which size to use. The kTableSize array only takes into account sizes for 8-bit first-level table lookups but not second-level table lookups. libwebp allows codes that are up to 15-bit (MAX_ALLOWED_CODE_LENGTH). When BuildHuffmanTable() attempts to fill the second-level tables it may write data out-of-bounds. The OOB write to the undersized array happens in ReplicateValue.
Notes:
This is only exploitable if the color_cache_bits value defines which size to use.
This vulnerability was also published on libwebp CVE-2023-5129
Changelog:
2023-09-12: Initial advisory publication
2023-09-27: Advisory details updated, including CVSS, references
2023-09-27: CVE-2023-5129 rejected as a duplicate of CVE-2023-4863
2023-09-28: Research and addition of additional affected libraries
2024-01-28: Additional fix information
Remediation
Upgrade sharp to version 0.32.6 or higher.
References
medium severity
- Vulnerable module: phin
- Introduced through: merge-img-vwv@2.1.5-up
Detailed paths
-
Introduced through: waifu-generator@TheRealBarenziah/waifu-generator#f9ac502a4b698badff2a680276bf94bb6fa1b935 › merge-img-vwv@2.1.5-up › jimp@0.16.1 › @jimp/custom@0.16.13 › @jimp/core@0.16.13 › phin@2.9.3
Overview
phin is a The ultra-lightweight Node.js HTTP client
Affected versions of this package are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor due to the handling of HTTP headers during redirects when followRedirects is enabled. An attacker can potentially intercept sensitive information by exploiting how headers are included in outgoing requests after a redirect.
Remediation
Upgrade phin to version 3.7.1 or higher.