sharp@0.11.4

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Use After Free via a memory-related vulnerability in the bundled librsvg dependency. An attacker can supply an SVG image that, when decoded through librsvg, triggers the memory corruption and results in arbitrary code execution on glibc-based Linux systems.

Note: This is only exploitable when the node executable is not compiled as a Position Independent Executable (PIE); the official Node.js binaries do not use this hardening feature, making them susceptible.

Upgrade sharp to version 0.35.5 or higher.

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Use After Free in entity_insert() and the entity map held on XmlState, which is shared between the outer parse and a recursive XInclude, so inserting an entity whose name already exists replaces the first entry and its Drop implementation calls xmlFreeNode() while the outer xmlCtxtParseEntity() is still using that 144 byte xmlEntity. An attacker can corrupt process memory by supplying an SVG document whose xi:include pulls in another document redefining an entity that is already active. This requires the application to parse attacker supplied SVG with XInclude processing reached, and the entity names must collide across the outer document and the included one.

Upgrade sharp to version 0.35.5 or higher.

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the VipsForeignLoadHeif process. An attacker can execute arbitrary code by providing specially crafted AVIF images as input.

Upgrade sharp to version 0.35.4 or higher.

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the bundled libvips TIFF loader (VipsForeignLoadTiff), which can miscount the channels of a tile encoded as JPEG or JPEG2000 within a TIFF image. An attacker can corrupt heap memory and crash the process, with a possibility of code execution, by supplying a TIFF whose JPEG or JPEG2000 tiles cause the channel count to be misdetermined and the buffer undersized. Exploitation requires the application to decode an untrusted TIFF with JPEG or JPEG2000 tiles through sharp.

Upgrade sharp to version 0.35.0 or higher.

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Out-of-bounds Read and null pointer dereference in the bundled libvips EXIF decoder, which does not validate the range of EXIF tag groups before passing them to libexif. An attacker can crash the process by supplying an image whose embedded EXIF metadata carries an out-of-range tag group. Exploitation requires the application to process an untrusted image whose EXIF metadata sharp reads.

Upgrade sharp to version 0.35.0 or higher.

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Integer Overflow in the bundled libvips GIF loader (VipsForeignLoadNsgif), which can miscompute image dimensions on 32-bit systems. An attacker can crash the process by supplying a GIF whose dimensions overflow the size calculation. Exploitation affects only 32-bit systems and requires the application to decode an untrusted GIF through sharp.

Upgrade sharp to version 0.35.0 or higher.

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Integer Overflow leading to a heap buffer overflow in the bundled libvips VIPS loader (VipsForeignLoadVips), which can miscompute image dimensions. An attacker can corrupt heap memory and crash the process, with a possibility of code execution, by supplying a VIPS (.vips) image whose dimensions overflow the size calculation. Exploitation requires the application to decode an untrusted VIPS image through sharp.

Upgrade sharp to version 0.35.0 or higher.

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Heap-based Buffer Overflow when the ReadHuffmanCodes() function is used. An attacker can craft a special WebP lossless file that triggers the ReadHuffmanCodes() function to allocate the HuffmanCode buffer with a size that comes from an array of precomputed sizes: kTableSize. The color_cache_bits value defines which size to use. The kTableSize array only takes into account sizes for 8-bit first-level table lookups but not second-level table lookups. libwebp allows codes that are up to 15-bit (MAX_ALLOWED_CODE_LENGTH). When BuildHuffmanTable() attempts to fill the second-level tables it may write data out-of-bounds. The OOB write to the undersized array happens in ReplicateValue.

Notes:

This is only exploitable if the color_cache_bits value defines which size to use.

This vulnerability was also published on libwebp CVE-2023-5129

Changelog:

2023-09-12: Initial advisory publication

2023-09-27: Advisory details updated, including CVSS, references

2023-09-27: CVE-2023-5129 rejected as a duplicate of CVE-2023-4863

2023-09-28: Research and addition of additional affected libraries

2024-01-28: Additional fix information

Upgrade sharp to version 0.32.6 or higher.