Homepage

org.webjars.npm:sharp@0.33.5

  • latest version

    0.33.5

  • first published

    8 years ago

  • latest version published

    9 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.npm:sharp package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Integer Overflow

    org.webjars.npm:sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

    Affected versions of this package are vulnerable to Integer Overflow leading to a heap buffer overflow in the bundled libvips VIPS loader (VipsForeignLoadVips), which can miscompute image dimensions. An attacker can corrupt heap memory and crash the process, with a possibility of code execution, by supplying a VIPS (.vips) image whose dimensions overflow the size calculation. Exploitation requires the application to decode an untrusted VIPS image through sharp.

    How to fix Integer Overflow?

    Upgrade org.webjars.npm:sharp to version 0.35.0 or higher.

    [0,0.35.0)
    • M
    Integer Overflow

    org.webjars.npm:sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

    Affected versions of this package are vulnerable to Integer Overflow in the bundled libvips GIF loader (VipsForeignLoadNsgif), which can miscompute image dimensions on 32-bit systems. An attacker can crash the process by supplying a GIF whose dimensions overflow the size calculation. Exploitation affects only 32-bit systems and requires the application to decode an untrusted GIF through sharp.

    How to fix Integer Overflow?

    Upgrade org.webjars.npm:sharp to version 0.35.0 or higher.

    [0,0.35.0)
    • M
    Out-of-bounds Read

    org.webjars.npm:sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

    Affected versions of this package are vulnerable to Out-of-bounds Read and null pointer dereference in the bundled libvips EXIF decoder, which does not validate the range of EXIF tag groups before passing them to libexif. An attacker can crash the process by supplying an image whose embedded EXIF metadata carries an out-of-range tag group. Exploitation requires the application to process an untrusted image whose EXIF metadata sharp reads.

    How to fix Out-of-bounds Read?

    Upgrade org.webjars.npm:sharp to version 0.35.0 or higher.

    [0,0.35.0)
    • H
    Heap-based Buffer Overflow

    org.webjars.npm:sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

    Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the bundled libvips TIFF loader (VipsForeignLoadTiff), which can miscount the channels of a tile encoded as JPEG or JPEG2000 within a TIFF image. An attacker can corrupt heap memory and crash the process, with a possibility of code execution, by supplying a TIFF whose JPEG or JPEG2000 tiles cause the channel count to be misdetermined and the buffer undersized. Exploitation requires the application to decode an untrusted TIFF with JPEG or JPEG2000 tiles through sharp.

    How to fix Heap-based Buffer Overflow?

    Upgrade org.webjars.npm:sharp to version 0.35.0 or higher.

    [0,0.35.0)
    Go back to all versions of this package