GHSA-cvhv-g4rq-3hmw: Low severity nuget/Magick.NET-Q16-HDRI-arm64 vulnerability
A memory leak is possible when invalid options are passed to the cli (magick)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/Magick.NET-Q16-HDRI-arm64to a version that resolves this vulnerability.Fixed in 14.15.0 - Upgrade
Upgrade
nuget/Magick.NET-Q8-x86to a version that resolves this vulnerability.Fixed in 14.15.0 - Upgrade
Upgrade
nuget/Magick.NET-Q8-x64to a version that resolves this vulnerability.Fixed in 14.15.0 - Upgrade
Upgrade
nuget/Magick.NET-Q8-arm64to a version that resolves this vulnerability.Fixed in 14.15.0 - Upgrade
Upgrade
nuget/Magick.NET-Q8-OpenMP-x64to a version that resolves this vulnerability.Fixed in 14.15.0 - Upgrade
Upgrade
nuget/Magick.NET-Q8-OpenMP-arm64to a version that resolves this vulnerability.Fixed in 14.15.0 - Upgrade
Upgrade
nuget/Magick.NET-Q8-AnyCPUto a version that resolves this vulnerability.Fixed in 14.15.0 - Upgrade
Upgrade
nuget/Magick.NET-Q16-x86to a version that resolves this vulnerability.Fixed in 14.15.0 - Upgrade
Upgrade
nuget/Magick.NET-Q16-x64to a version that resolves this vulnerability.Fixed in 14.15.0 - Upgrade
Upgrade
nuget/Magick.NET-Q16-arm64to a version that resolves this vulnerability.Fixed in 14.15.0 - Upgrade
Upgrade
nuget/Magick.NET-Q16-OpenMP-x64to a version that resolves this vulnerability.Fixed in 14.15.0 - Upgrade
Upgrade
nuget/Magick.NET-Q16-OpenMP-arm64to a version that resolves this vulnerability.Fixed in 14.15.0 - Upgrade
Upgrade
nuget/Magick.NET-Q16-HDRI-x86to a version that resolves this vulnerability.Fixed in 14.15.0 - Upgrade
Upgrade
nuget/Magick.NET-Q16-HDRI-x64to a version that resolves this vulnerability.Fixed in 14.15.0 - Upgrade
Upgrade
nuget/Magick.NET-Q16-HDRI-OpenMP-arm64to a version that resolves this vulnerability.Fixed in 14.15.0 - Upgrade
Upgrade
nuget/Magick.NET-Q16-HDRI-AnyCPUto a version that resolves this vulnerability.Fixed in 14.15.0 - Upgrade
Upgrade
nuget/Magick.NET-Q16-AnyCPUto a version that resolves this vulnerability.Fixed in 14.15.0
Event History
Frequently Asked Questions
What access would an attacker need to trigger the issue?
The CVSS vector indicates local access and user interaction are required. The issue is associated with passing invalid options to the magick CLI.
Which Magick.NET packages are identified as affected?
The listed packages are Magick.NET-Q16-HDRI-arm64, Magick.NET-Q8-x86, Magick.NET-Q8-arm64, Magick.NET-Q8-OpenMP-x64, Magick.NET-Q8-OpenMP-arm64, Magick.NET-Q8-AnyCPU, Magick.NET-Q16-x86, and Magick.NET-Q16-arm64.