Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A bounds verification of a slice storage of a 2-dimensional matrix's coefficients (a kernel) would compare the total size against the product of individual dimensions. This would erroneously cast after the multiplication and consequently fail to detect possible violations when overflow occurs. Afterwards, the individual sizes were trusted to properly constrain coordinates within the matrix to indices valid for the underlying storage. With a crafted Kernel object, certain combinations of coordinates could then cause an out-of-bounds access in an unsafe function while fulfilling its documented preconditions. The kernel value could be passed to library functions that trusted the preconditions and then performed such reads.
Recommended action: Upgrade to 0.26.2, 0.25.1, 0.24.1 or 0.23.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A bounds check was performed in floating points before a cast to the index passed to an unchecked access function. This checked considered NaN cases improperly, causing them to succeed the check instead of failing it. The floating point coordinate is under caller control by passing a selected projection matrix. Carefully controlling the coordinates of an image with no data and one non-zero dimension provides an arbitrary read primitive in the first 32-bits of address space with a Bilinear sampling method. Using bicubic sampling can result in a read of a few bytes beyond an allocation. Other out-of-bounds reads may be possible.
Recommended action: Upgrade to 0.26.2, 0.25.1, 0.24.1 or 0.23.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A read of pixels was coded as modifying coordinates to lie within the image bounds. It would calculate a coordinate by adding a constant to an input and taking the minimum of the resulting coordinate and 'dimension - 1'. This would not protect against malicious inputs that could overflow the addition. Following the tricked bounds check, the image could then be sampled at multiple differently calculated coordinates that exceeded the bounds.
Recommended action: Upgrade to 0.26.2, 0.25.1 or 0.24.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.