sharp@0.0.7 vulnerabilities

High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

  • latest version

    0.33.5

  • latest non vulnerable version

  • first published

    11 years ago

  • latest version published

    3 months ago

  • licenses detected

  • Direct Vulnerabilities

    Known vulnerabilities in the sharp package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    Heap-based Buffer Overflow

    sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

    Affected versions of this package are vulnerable to Heap-based Buffer Overflow when the ReadHuffmanCodes() function is used. An attacker can craft a special WebP lossless file that triggers the ReadHuffmanCodes() function to allocate the HuffmanCode buffer with a size that comes from an array of precomputed sizes: kTableSize. The color_cache_bits value defines which size to use. The kTableSize array only takes into account sizes for 8-bit first-level table lookups but not second-level table lookups. libwebp allows codes that are up to 15-bit (MAX_ALLOWED_CODE_LENGTH). When BuildHuffmanTable() attempts to fill the second-level tables it may write data out-of-bounds. The OOB write to the undersized array happens in ReplicateValue.

    Notes:

    This is only exploitable if the color_cache_bits value defines which size to use.

    This vulnerability was also published on libwebp CVE-2023-5129

    Changelog:

    2023-09-12: Initial advisory publication

    2023-09-27: Advisory details updated, including CVSS, references

    2023-09-27: CVE-2023-5129 rejected as a duplicate of CVE-2023-4863

    2023-09-28: Research and addition of additional affected libraries

    2024-01-28: Additional fix information

    How to fix Heap-based Buffer Overflow?

    Upgrade sharp to version 0.32.6 or higher.

    <0.32.6
    • M
    Remote Code Execution (RCE)

    sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

    Affected versions of this package are vulnerable to Remote Code Execution (RCE). There is a possible vulnerability in logic that is run only at npm install time when installing the package. If an attacker has the ability to set the value of the PKG_CONFIG_PATH environment variable in a build environment then they might be able to use this to inject an arbitrary command at npm install time. This is not part of any runtime code and does not affect Windows users at all.

    How to fix Remote Code Execution (RCE)?

    Upgrade sharp to version 0.30.5 or higher.

    <0.30.5