Image
Monthly
Bundled-dependency exposure in the Image::WebP Perl module (versions 0 through 0.2, distributed by CPAN author ZAPAD) ships a statically compiled copy of libwebp 0.3.0 from 2013, which contains multiple known decoder flaws including the critical CVE-2023-4863 heap buffer overflow. Any Perl application that uses this module to decode an attacker-supplied WebP image reaches the outdated internal decoder, potentially enabling memory corruption and remote code execution. There is no public exploit identified for this specific repackaging, EPSS is low at 0.17%, and CISA SSVC records exploitation status as none - but the embedded CVE-2023-4863 was historically a high-impact, widely-abused decoder bug.
Use of an unmaintained third-party component in the Perl module Image::EPEG (through version 0.15) exposes users to any latent flaws in the bundled Epeg 0.9.0 JPEG thumbnailing library, which was last updated in 2004 and is no longer supported. Reported by CPANSec (CWE-1104), the core issue is that any JPEG-decoding vulnerability in this two-decade-old embedded library will never receive an upstream fix. There is no public exploit identified at time of analysis, EPSS exploitation probability is low (0.17%), and the assigned CVSS of 9.8 appears to reflect worst-case memory-corruption potential in image parsing rather than a specific demonstrated flaw.
The TIFF decoder does not place a limit on the size of compressed tile data. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
A maliciously-crafted image can cause excessive CPU consumption in decoding. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in the image crate before 0.23.12 for Rust. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Bundled-dependency exposure in the Image::WebP Perl module (versions 0 through 0.2, distributed by CPAN author ZAPAD) ships a statically compiled copy of libwebp 0.3.0 from 2013, which contains multiple known decoder flaws including the critical CVE-2023-4863 heap buffer overflow. Any Perl application that uses this module to decode an attacker-supplied WebP image reaches the outdated internal decoder, potentially enabling memory corruption and remote code execution. There is no public exploit identified for this specific repackaging, EPSS is low at 0.17%, and CISA SSVC records exploitation status as none - but the embedded CVE-2023-4863 was historically a high-impact, widely-abused decoder bug.
Use of an unmaintained third-party component in the Perl module Image::EPEG (through version 0.15) exposes users to any latent flaws in the bundled Epeg 0.9.0 JPEG thumbnailing library, which was last updated in 2004 and is no longer supported. Reported by CPANSec (CWE-1104), the core issue is that any JPEG-decoding vulnerability in this two-decade-old embedded library will never receive an upstream fix. There is no public exploit identified at time of analysis, EPSS exploitation probability is low (0.17%), and the assigned CVSS of 9.8 appears to reflect worst-case memory-corruption potential in image parsing rather than a specific demonstrated flaw.
The TIFF decoder does not place a limit on the size of compressed tile data. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
A maliciously-crafted image can cause excessive CPU consumption in decoding. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in the image crate before 0.23.12 for Rust. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.