libvips v8.18.3 Security Advisory: Multiple Vulnerabilities (OOB, Heap Overflow, NULL Deref)

Vulnerability Overview In libvips version 8.18.3, multiple security vulnerabilities exist, primarily involving input validation, memory management, and boundary check issues. These vulnerabilities could lead to severe consequences such as program crashes, data leaks, or remote code execution. Affected Scope invertlut: Validates input mask positions. bandjoin_const: Fixes potential Out-of-Bounds (OOB) reads with RAD/LABQ images. edge: Ensures the parent object is built. object: Prevents invalid interpolators. foreign: Prevents NULL filenames. std::expand: Expands input by one column. dcrawload: Supports non-square pixels. image_sanity: Ensures scanlines are within INT_MAX. rank: Expands input by one column. hist_local: Expands input by one column. p2ksave: Fixes null pointer dereference in the quantization backend. p2ksave: Fixes OOB reads during chroma subsampling. p2ksave: Prevents heap buffer overflows in non-RGB images. heifload: Tightens memory usage limits. boolean: Fixes heap buffer overflow in iShift. magicload: Checks animation height. source: Fixes max/min confusion. uhdsave: Uses macros to size buffers. draw_mask: Supports packed LABQ images. reduceh: Fixes OOB reads in the Highway path. buildlut: Checks boundaries for x ranges. jxl: Ensures status codes are propagated. archive: Fixes compatibility with MSVC. ppmload: Checks image dimensions. thumbnail: Better pyr detection. jpegsave: Fixes script saving when uhdr is disabled. Remediation invertlut: Validates input mask positions. bandjoin_const: Fixes potential Out-of-Bounds (OOB) reads with RAD/LABQ images. edge: Ensures the parent object is built. object: Prevents invalid interpolators. foreign: Prevents NULL filenames. std::expand: Expands input by one column. dcrawload: Supports non-square pixels. image_sanity: Ensures scanlines are within INT_MAX. rank: Expands input by one column. hist_local: Expands input by one column. p2ksave: Fixes null pointer dereference in the quantization backend. p2ksave: Fixes OOB reads during chroma subsampling. p2ksave: Prevents heap buffer overflows in non-RGB images. heifload: Tightens memory usage limits. boolean: Fixes heap buffer overflow in iShift. magicload: Checks animation height. source: Fixes max/min confusion. uhdsave: Uses macros to size buffers. draw_mask: Supports packed LABQ images. reduceh: Fixes OOB reads in the Highway path. buildlut: Checks boundaries for x ranges. jxl: Ensures status codes are propagated. archive: Fixes compatibility with MSVC. ppmload: Checks image dimensions. thumbnail: Better pyr detection. jpegsave: Fixes script saving when uhdr is disabled. POC Code or Exploitation Code No specific POC code or exploitation code is provided in the page. Summary Multiple security vulnerabilities exist in libvips version 8.18.3, primarily involving input validation, memory management, and boundary check issues. Remediation measures include validating input mask positions, fixing Out-of-Bounds (OOB) reads, ensuring the parent object is built, preventing invalid interpolators, preventing NULL filenames, expanding input by one column, supporting non-square pixels, ensuring scanlines are within INT_MAX, fixing null pointer dereference in the quantization backend, fixing OOB reads during chroma subsampling, preventing heap buffer overflows in non-RGB images, tightening memory usage limits, fixing heap buffer overflow in iShift, checking animation height, fixing max/min confusion, using macros to size buffers, supporting packed LABQ images, fixing OOB reads in the Highway path, checking boundaries for x ranges, ensuring status codes are propagated, fixing compatibility with MSVC, checking image dimensions, better pyr detection, and fixing script saving when uhdr is disabled.

Goal Reached Thanks to every supporter — we hit 100%!

libvips v8.18.3 Security Advisory: Multiple Vulnerabilities (OOB, Heap Overflow, NULL Deref)

More from this source