CVE-2020-28248: Integer Overflow in png-img
Summary
CVE-2020-28248: Integer Overflow in png-img. Affects png-img versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The png-img package is an npm package used for working with PNG images. It provides functionality for loading and manipulating PNG files. The package is vulnerable to an integer overflow in the PngImg::InitStorage_() function. This vulnerability occurs when the function fails to allocate enough heap memory, leading to a heap-based buffer overflow. This vulnerability can be exploited by loading a specially crafted PNG file.
Vulnerability Detail
The integer overflow vulnerability in png-img can result in an under-allocation of heap memory, which can then be exploited to trigger a heap-based buffer overflow. An attacker can create a malicious PNG file that, when loaded by an application using the png-img package, can cause the application to overwrite adjacent memory, potentially leading to arbitrary code execution or a denial of service. The vulnerability has a CVSS score of 8.8, indicating a high severity.
How To Fix
Minimum fixed version
3.1.0
This is the first release that contains the fix.
npm install png-img@3.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the package to the latest version as soon as possible.
Conclusion
The png-img package is vulnerable to an integer overflow issue that can lead to a heap-based buffer overflow. This vulnerability can be exploited by loading a specially crafted PNG file. To mitigate the risk, it is recommended to update the package to version 3.1.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for png-img →
FAQ
This vulnerability can allow an attacker to execute arbitrary code or cause a denial of service by exploiting the heap-based buffer overflow.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the tool will analyze it for vulnerabilities.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Yes, the png-img package has released a fix for this vulnerability in version 3.1.0. It is recommended to update to this version or later.
There is no known workaround for this vulnerability. It is highly recommended to update the package to the latest version to mitigate the risk.
