Golang TIFF decoder vulnerable to excessive CPU consumption

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2023-29407 · ADVISORY
• go.dev/cl/514897 · WEB
• go.dev/issue/61581 · WEB
• lists.fedoraproject.org/archives/list/[email protected]/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6 · WEB
• lists.fedoraproject.org/archives/list/[email protected]/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2 · WEB
• lists.fedoraproject.org/archives/list/[email protected]/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK · WEB
• pkg.go.dev/vuln/GO-2023-1990 · WEB
• security.netapp.com/advisory/ntap-20230831-0009 · WEB
• lists.fedoraproject.org/archives/list/[email protected]/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6 · Mailing List
• lists.fedoraproject.org/archives/list/[email protected]/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2 · Mailing List
• lists.fedoraproject.org/archives/list/[email protected]/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK
• security.netapp.com/advisory/ntap-20230831-0009 · Third Party Advisory

Lỗ hổng khác của golang.org/x/image

• CVE-2026-46603CAO 7.5VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unu…
• CVE-2026-46604CAO 7.5The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.
• CVE-2026-46602CAO 7.5The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large …
• CVE-2026-46601CAO 7.5The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
• CVE-2026-46599CAO 7.5The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a sma…