Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing
Vulnerability Description
bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The buffer created for parsing metadata for PNG and WebP images was only bounded by their input data type, which could lead to potentially large memory allocation, and unreasonably high for image metadata. Before v0.11.0, If you didn't trust the input images, this could be abused to construct denial-of-service attacks. v0.11.0 added a 10 MB upper limit.
CVSS Information
N/A
Vulnerability Type
不加限制或调节的资源分配
Vulnerability Title
imagemeta 安全漏洞
Vulnerability Description
imagemeta是Bjørn Erik Pedersen个人开发者的一个Go库。用于从JPEG、TIFF、PNG和WebP文件中读取EXIF、IPTC和XMP图像元数据。 imagemeta v0.11.0之前版本存在安全漏洞，该漏洞源于未限制PNG和WebP元数据缓冲区大小，可能导致内存分配过大。
CVSS Information
N/A
Vulnerability Type
N/A