Threats tagged 'ghsa-c4x5-qr47-7gw4'

imgproxy versions from 3.3.0 up to but not including 4.0.17 contain a vulnerability in the ICO image loader. This flaw involves an out-of-bounds heap read and write during BMP header reconstruction when processing ICO entries with tiny data sizes. An unauthenticated attacker can exploit this by supplying a crafted ICO image, causing heap corruption and triggering a glibc abort that crashes the worker process.