Heap-use-after-free in start_pass_phuff_decoder in libvips
Summary
OSV-2022-303: Heap-use-after-free in start_pass_phuff_decoder. Affects libvips versions >= 89bd46d1c4e0465974b886ef5b5021e988f111a2, < 2dc319b1b1610e4c8ae95b8ca47b46926cd41ce1. Fixed in 2dc319b1b1610e4c8ae95b8ca47b46926cd41ce1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libvips is an open-source image processing library that provides a wide range of image manipulation functions. It is commonly used in various applications and frameworks to handle image processing tasks efficiently. However, a vulnerability has been discovered in the library that could lead to a heap-use-after-free issue.
Vulnerability Detail
The vulnerability, identified as OSV-2022-303, originates from a heap-use-after-free write of 4 bytes. The crash occurs in the 'start_pass_phuff_decoder' function, specifically in the 'start_input_pass' and 'jinit_master_decompress' functions. This vulnerability can be triggered under certain conditions, potentially leading to a crash or enabling an attacker to execute arbitrary code. The issue was reported through OSS-Fuzz, and more details can be found in the provided link.
How To Fix
Minimum fixed version
2dc319b1b1610e4c8ae95b8ca47b46926cd41ce1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At the moment, no specific workaround has been provided for this vulnerability. It is advised to update to the fixed version as soon as possible.
Conclusion
In conclusion, the libvips library is affected by a heap-use-after-free vulnerability in the 'start_pass_phuff_decoder' function. It is crucial to update to a fixed version of the library to mitigate the risk of crashes or potential code execution. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for libvips →
FAQ
libvips is an open-source image processing library used for various image manipulation tasks.
A heap-use-after-free vulnerability occurs when a program attempts to access memory that has already been freed. This can lead to crashes or potential code execution.
This vulnerability was discovered through OSS-Fuzz, a continuous fuzzing service for open-source software.
This vulnerability could potentially lead to crashes or enable an attacker to execute arbitrary code, depending on the specific conditions and exploitation techniques.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for libvips.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
