CVE-2024-32036

Katalog CVE

CVSS 6.5 · Medium EPSS 0,58%

Kerentanan Sensitive Information in Resource Not Removed Before Reuse pada sixlabors imagesharp. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer. The problem has been patched in v3.1.4 and v2.1.8.

Rincian

Terbit di NVD

15 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-226: Sensitive Information in Resource Not Removed Before Reuse
CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 45,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-5x7m-6737-26cr advisory vendor
• https://github.com/SixLabors/ImageSharp/commit/8f0b4d3e680e78d479a88e7b1472bccd8f096d68 patch
• https://github.com/SixLabors/ImageSharp/commit/da5f09a42513489fe359578d81cec2f15ba588ba patch