golang-github-disintegration-imaging: CVE-2023-36308

Debian Bug report logs - #1069062
golang-github-disintegration-imaging: CVE-2023-36308

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Maytham Alsudany <maytha8thedev@gmail.com>

To: submit@bugs.debian.org

Subject: golang-github-disintegration-imaging: CVE-2023-36308

Date: Mon, 15 Apr 2024 21:30:20 +0300

[Message part 1 (text/plain, inline)]

Package: golang-github-disintegration-imaging
X-Debbugs-CC: team@security.debian.org
Severity: normal
Tags: security

Hi,

The following vulnerability was published for golang-github-disintegration-imaging.

CVE-2023-36308[0]:
| disintegration Imaging 1.6.2 allows attackers to cause a panic
| (because of an integer index out of range during a Grayscale call)
| via a crafted TIFF file to the scan function of scanner.go. NOTE: it
| is unclear whether there are common use cases in which this panic
| could have any security consequence


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-36308
    https://www.cve.org/CVERecord?id=CVE-2023-36308

Please adjust the affected versions in the BTS as needed.

Kind regards,
Maytham

[signature.asc (application/pgp-signature, inline)]

Message #12 received at 1069062-submitter@bugs.debian.org (full text, mbox, reply):

From: Maytham Alsudany <maytha8thedev@gmail.com>

To: 1069062-submitter@bugs.debian.org

Subject: Bug#1069062 marked as pending in golang-github-disintegration-imaging

Date: Mon, 15 Apr 2024 19:11:35 +0000

Control: tag -1 pending

Hello,

Bug #1069062 in golang-github-disintegration-imaging reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/go-team/packages/golang-github-disintegration-imaging/-/commit/24e17d9e3f43e89f533923139ad87de63690ab7d

------------------------------------------------------------------------
Fix vulnerability that allows attackers to cause a panic via a crafted TIFF file to the scan function of scanner.go (CVE-2023-36308)

Closes: #1069062
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1069062

Send a report that this bug log contains spam.