CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-24792 – Panic when parsing invalid palette-color images in golang.org/x/image
https://notcve.org/view.php?id=CVE-2024-24792
27 Jun 2024 — Parsing a corrupt or malicious image with invalid color indices can cause a panic. An update that fixes one vulnerability is now available. This update for keybase-client fixes the following issues. • https://go.dev/cl/588115 •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-29407 – Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff
https://notcve.org/view.php?id=CVE-2023-29407
02 Aug 2023 — A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero. • https://go.dev/cl/514897 • CWE-834: Excessive Iteration •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-29408 – Excessive resource consumption in golang.org/x/image/tiff
https://notcve.org/view.php?id=CVE-2023-29408
02 Aug 2023 — The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU. An update that fixes one vulnerability is now available. This update for keybase-client fixes the following issues. • https://go.dev/cl/514897 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-41727 – Denial of service via crafted TIFF image in golang.org/x/image/tiff
https://notcve.org/view.php?id=CVE-2022-41727
28 Feb 2023 — An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service. • https://go.dev/cl/468195 • CWE-770: Allocation of Resources Without Limits or Throttling •