CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-29407 – Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff
https://notcve.org/view.php?id=CVE-2023-29407
02 Aug 2023 — A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero. • https://go.dev/cl/514897 • CWE-834: Excessive Iteration •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-29408 – Excessive resource consumption in golang.org/x/image/tiff
https://notcve.org/view.php?id=CVE-2023-29408
02 Aug 2023 — The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU. An update that fixes one vulnerability is now available. This update for keybase-client fixes the following issues. • https://go.dev/cl/514897 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-41727 – Denial of service via crafted TIFF image in golang.org/x/image/tiff
https://notcve.org/view.php?id=CVE-2022-41727
28 Feb 2023 — An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service. • https://go.dev/cl/468195 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-35916
https://notcve.org/view.php?id=CVE-2020-35916
31 Dec 2020 — An issue was discovered in the image crate before 0.23.12 for Rust. A Mutable reference has immutable provenance. (In the case of LLVM, the IR may be always correct.) Se detectó un problema en la crate image versiones anteriores a 0.23.12 para Rust. Una referencia mutable presenta una procedencia inmutable. • https://rustsec.org/advisories/RUSTSEC-2020-0073.html • CWE-400: Uncontrolled Resource Consumption •