| id: GO-2024-2937 |
| modules: |
| - module: golang.org/x/image |
| versions: |
| - fixed: 0.18.0 |
| vulnerable_at: 0.17.0 |
| packages: |
| - package: golang.org/x/image/tiff |
| symbols: |
| - decoder.decode |
| derived_symbols: |
| - Decode |
| summary: Panic when parsing invalid palette-color images in golang.org/x/image |
| description: |- |
| Parsing a corrupt or malicious image with invalid color indices can cause a |
| panic. |
| ghsas: |
| - GHSA-9phm-fm57-rhg8 |
| related: |
| - CVE-2023-36308 |
| credits: |
| - John Wright <jsw@google.com> |
| references: |
| - fix: https://go.dev/cl/588115 |
| - report: https://go.dev/issue/67624 |
| cve_metadata: |
| id: CVE-2024-24792 |
| cwe: 'CWE-125: Out-of-bounds Read' |
| source: |
| id: go-security-team |
| created: 2024-06-18T13:47:44.577511-07:00 |
| review_status: REVIEWED |
