CVE-2024-32036: SixLabors.ImageSharp vulnerable to data leakage
Impact A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer.
Patches The problem has been patched. All users are advised to upgrade to v3.1.4 or v2.1.8.
Workarounds None
References None
Other sources
ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer. The problem has been patched in v3.1.4 and v2.1.8.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-32036?
CVE-2024-32036 is classified as a medium severity vulnerability due to its potential to leak sensitive information.
How do I fix CVE-2024-32036?
To fix CVE-2024-32036, update SixLabors.ImageSharp to version 3.1.4 or later, or to version 2.1.8 for earlier releases.
What types of files are affected by CVE-2024-32036?
CVE-2024-32036 affects JPEG and TGA image files processed by ImageSharp.
Who is affected by CVE-2024-32036?
Any application that uses vulnerable versions of SixLabors.ImageSharp to decode JPEG or TGA images is affected by CVE-2024-32036.
Is there a known exploit for CVE-2024-32036?
As of now, there are no public exploits specifically targeting CVE-2024-32036 reported.