chore(deps): update dependency sixlabors.imagesharp to v2 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
SixLabors.ImageSharp	1.0.3 -> 2.1.9

GitHub Vulnerability Alerts

CVE-2024-27929

Impact

A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure.

Patches

The problem has been patched. All users are advised to upgrade to v3.1.3 or v2.1.7.

Workarounds

None

References

None

CVE-2024-32035

Impact

A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in image decoders. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw.

This flaw can be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on ImageSharp for image processing tasks. Users and administrators are advised to update to the latest version of ImageSharp that addresses this vulnerability to mitigate the risk of exploitation.

Patches

The problem has been patched. All users are advised to upgrade to v3.1.4 or v2.1.8.

Workarounds

Before calling Image.Decode(Async), use Image.Identify to determine the image dimensions in order to enforce a limit.

References

• ImageSharp: Security Considerations
• ImageSharp.Web: Securing Processing Commands

CVE-2024-32036

Impact

A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer.

Patches

The problem has been patched. All users are advised to upgrade to v3.1.4 or v2.1.8.

Workarounds

None

References

None

CVE-2024-41131

Impact

An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service.

Patches

The problem has been patched. All users are advised to upgrade to v3.1.5 or v2.1.9.

Workarounds

None.

References

https://github.com/SixLabors/ImageSharp/pull/2754
https://github.com/SixLabors/ImageSharp/pull/2756

CVE-2024-41132

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw.

Patches

Has the problem been patched? What versions should users upgrade to?

The problem has been patched. All users are advised to upgrade to v3.1.5 or v2.1.9.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Before calling Image.Decode(Async), use Image.Identify to determine the image dimensions in order to enforce a limit.

References

Are there any links users can visit to find out more?

• https://github.com/SixLabors/ImageSharp/pull/2759
• https://github.com/SixLabors/ImageSharp/pull/2764
• https://github.com/SixLabors/ImageSharp/pull/2770
• ImageSharp: Security Considerations
• ImageSharp.Web: Securing Processing Commands

---

Release Notes

SixLabors/ImageSharp (SixLabors.ImageSharp)

v2.1.9

What's Changed

• [2.1] Fix overflow in MemoryAllocator.Create(options) by @​antonfirsov in https://github.com/SixLabors/ImageSharp/pull/2732
• Backport GIF LZW fix to 2.1 by @​antonfirsov in https://github.com/SixLabors/ImageSharp/pull/2756
• Backport 2759 to 2.1.x by @​antonfirsov in https://github.com/SixLabors/ImageSharp/pull/2770

Full Changelog: SixLabors/ImageSharp@v2.1.8...v2.1.9

v2.1.8

What's Changed

• V2 - Limit Read Palette Indices by @​JimBobSquarePants in https://github.com/SixLabors/ImageSharp/pull/2719
• V2 - Clear Pixel Buffers on Decode. by @​JimBobSquarePants in https://github.com/SixLabors/ImageSharp/pull/2717
• V2 - Limit all memory allocations in the MemoryAllocator layer by @​JimBobSquarePants in https://github.com/SixLabors/ImageSharp/pull/2715

Full Changelog: SixLabors/ImageSharp@v2.1.7...v2.1.8

v2.1.7

What's Changed

• [release/2.1] Disallow allocation attempts of unrepresentable sizes by @​antonfirsov in https://github.com/SixLabors/ImageSharp/pull/2553
• [release/2.1] Tiff decoding robustness improvements (#​2550) by @​antonfirsov in https://github.com/SixLabors/ImageSharp/pull/2554
• [release/2.1] PBM decoder robustness improvements and BufferedReadStream observability by @​antonfirsov in https://github.com/SixLabors/ImageSharp/pull/2555
• Backport 2681 by @​JimBobSquarePants in https://github.com/SixLabors/ImageSharp/pull/2688

Full Changelog: SixLabors/ImageSharp@v2.1.6...v2.1.7

v2.1.6

What's Changed

• Backport - Handle EOF in Jpeg bit reader when data is bad to prevent DOS attack. by @​JimBobSquarePants in https://github.com/SixLabors/ImageSharp/pull/2524

Full Changelog: SixLabors/ImageSharp@v2.1.5...v2.1.6

v2.1.5

What's Changed

• Backport #​2501 by @​JimBobSquarePants in https://github.com/SixLabors/ImageSharp/pull/2509

Full Changelog: SixLabors/ImageSharp@v2.1.4...v2.1.5

v2.1.4

What's Changed

• Backport WebP fix to 2.1 by @​antonfirsov in https://github.com/SixLabors/ImageSharp/pull/2420

Full Changelog: SixLabors/ImageSharp@v2.1.3...v2.1.4

v2.1.3

What's Changed

• V2 Backport: 2133, 2154 by @​JimBobSquarePants in https://github.com/SixLabors/ImageSharp/pull/2157

Full Changelog: SixLabors/ImageSharp@v2.1.2...v2.1.3

v2.1.2

What's Changed

• Backport - Issue 2123 by @​JimBobSquarePants in https://github.com/SixLabors/ImageSharp/pull/2126

Full Changelog: SixLabors/ImageSharp@v2.1.1...v2.1.2

v2.1.1

What's Changed

• Memory allocation allocation tracker test helper by @​tocsoft in https://github.com/SixLabors/ImageSharp/pull/2082
• Added sanity check for every jpeg marker by @​br3aker in https://github.com/SixLabors/ImageSharp/pull/2084
• Fixed string exif value corner case exception by @​br3aker in https://github.com/SixLabors/ImageSharp/pull/2088
• Add missing decoder sanitation checks by @​JimBobSquarePants and @​brianpopow in https://github.com/SixLabors/ImageSharp/pull/2077

Full Changelog: SixLabors/ImageSharp@v2.1.0...v2.1.1

v2.1.0

Advisories and Breaking Changes

• Fix async image load - #​2006 via @​kroymann, @​antonfirsov, @​JimBobSquarePants

Release Notes

Area:Performance

• PNG: Add SSE/AVX version of Sub, Up, Average and Paethfilters - #​2028 via @​brianpopow, @​JimBobSquarePants
• Add AVX2 version of adler32 - #​2024 via @​brianpopow

Bug

• Gif decoder. Fix memory access violations. - #​2014 via @​JimBobSquarePants
• Fix issue in PNG identify method to skip "uninteresting" chunks, incl… - #​2019 via @​flew2bits, @​brianpopow, @​JimBobSquarePants
• Ensure PixelOperations.To(TPixel) uses scaling. - #​2050 via @​JimBobSquarePants
• Fix issue with app1 parsing - #​2058 via @​brianpopow
• Fix resize pad color application for non Nearest Neighbor samplers - #​2052 via @​JimBobSquarePants

Codequality

• naming corrections - macOS and .NET - #​2065 via @​mikeirvingweb, @​JimBobSquarePants

Documentation

• Fix documentation of HorizontalResolution and VerticalResolution properties - #​1981 via @​0xced

Enhancement

• Allow pad to work for non-alpha pixel formats - #​2034 via @​JimBobSquarePants

Formats:Jpeg

• Fixed multiple SpectralConverter.CommitConversion() calls - #​2000 via @​br3aker

Formats:Png

• PNG: Throw exception, if palette chunk is missing - #​2020 via @​brianpopow
• PNG: Ignore invalid gamma chunks - #​2021 via @​brianpopow
• Optimize Crc32 for arm - #​1987 via @​Bond-009, @​brianpopow
• Add ARM version of adler32 - #​2015 via @​brianpopow, @​antonfirsov, @​JimBobSquarePants
• Minor PNG Encoding Optimization for DeflaterEngine and WuQuantizer - #​2023 via @​ratok-mk, @​JimBobSquarePants

Formats:Tiff

• Add TIFF CcittGroup4Fax (T6) compression - #​1993 via @​frankracis-work, @​brianpopow
• Add support for decoding gray tiff with jpeg compression - #​2031 via @​brianpopow
• Tiff Decoder option to decode only first frame - #​2013 via @​brianpopow, @​JimBobSquarePants
• Add support for decoding Tiff images with UnassociatedAlphaData - #​2037 via @​brianpopow, @​JimBobSquarePants
• TIFF: Add support for horizontal predictor with alpha data - #​2047 via @​brianpopow, @​JimBobSquarePants
• Add support for decoding Tiff images with associated alpha data - #​2062 via @​brianpopow, @​JimBobSquarePants

Metadata:Exif

• Fix null reference exception on Exif clone of null ExifArrayValue - #​2059 via @​ynse01, @​brianpopow

• Add non-generic overload for ExifProfile.CreateThumbnail(). by @​JimBobSquarePants in https://github.com/SixLabors/ImageSharp/pull/2066

Other

• Respect PreferContiguousImageBuffers in decoders - #​1999 via @​antonfirsov
• Workaround GC.GetMemoryInfo() ARM32 issue - #​2025 via @​antonfirsov, @​JimBobSquarePants
• AVX conversions for Luminance and Rgb - #​2039 via @​ynse01, @​JimBobSquarePants
• Improved jpeg encoding benchmarks - #​2051 via @​br3aker, @​JimBobSquarePants

Unit Tests

• BenchmarkDotNet config obsolete method usage fix - #​2042 via @​br3aker

New Contributors

• @​0xced made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1981
• @​frankracis-work made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1993
• @​flew2bits made their first contribution in https://github.com/SixLabors/ImageSharp/pull/2019
• @​ratok-mk made their first contribution in https://github.com/SixLabors/ImageSharp/pull/2023
• @​kroymann made their first contribution in https://github.com/SixLabors/ImageSharp/pull/2006
• @​mikeirvingweb made their first contribution in https://github.com/SixLabors/ImageSharp/pull/2065

Full Changelog: SixLabors/ImageSharp@v2.0.0...v2.1.0

v2.0.0

Advisories and Breaking Changes

Major breaking changes

• Due to the new unmanaged memory engine, we had to redesign our pixel processing and low level memory management API-s. The most visible change is that the GetPixelRowSpan() methods have been replaced with ProcessPixelRows() variants. This was done to guarantee memory safety. For more details see:
  • 2.0 documentation on Working with Pixel Buffers
  • 2.0 documentation on Memory Management
  • Pixel processing breaking changes & API discussion - #​1739
• Png and Jpeg now decode to pixels formats closer to the encoded format when using the non-generic API. (For example Jpeg now decodes to Image<Rgb24> instead of Image<Rgba32>.) This was done to reduce memory usage and remove some surprises for users.
• We've dropped the old NetStandard 1.3 target. This targeted frameworks not supported by Microsoft and was adding overhead to development.

Complete list of breaking PR-s

• Add Abgr32 pixel type, extend IPixel - #​1886 via @​ynse01, @​antonfirsov, @​JimBobSquarePants
• Remove netstandard 1.3 target - #​1888 via @​JimBobSquarePants
• ImageFormatDetector Configuration Cleanup - #​1936 via @​JimBobSquarePants
• Unmanaged pooling MemoryAllocator - #​1730 via @​antonfirsov
• Png - Preserve Pixel Format for Non-generic decode. - #​1861 via @​JimBobSquarePants
• Decode Jpeg into Rgb24 when pixel type not specified. - #​1773

Release Notes

API

• Remove HistogramEqualizationOptions.Default - #​1840 via @​antonfirsov
• Added missing CancellationToken parameters to Image - #​1856 via @​justinbhopper
• Expose ImageFrame.PixelBuffer - #​1906 via @​JimBobSquarePants
• Change the constructor of PixelTypeInfo and ImageMetadata from internal to public so that a user can implement IImageInfo - #​1929 via @​jz5, @​antonfirsov, @​JimBobSquarePants

Area:Build

• Update codcov and config - #​1820 via @​JimBobSquarePants
• Use a scheduled job for codecov - #​1934 via @​JimBobSquarePants

Area:Formats

• Add support for Portable Bitmap images - #​1851 via @​ynse01, @​antonfirsov, @​brianpopow, @​JimBobSquarePants

Area:Performance

• Webp: Use byte arrays instead of Dictionary's for lookups - #​1800 via @​brianpopow
• Add sse2 version of select - #​1804 via @​brianpopow
• Add SSE2 versions of ClampedAddSubtractFull and ClampedAddSubtractHalf - #​1805 via @​brianpopow, @​JimBobSquarePants
• SSE41 version of Hadamard transform - #​1810 via @​brianpopow
• Add SSE41 version of Quantize block - #​1811 via @​brianpopow
• Add SSE2 version of Mean16x4 - #​1814 via @​brianpopow
• Add SSE2 version of Vp8Sse4X4 - #​1817 via @​brianpopow
• Hoist some of the calculations from loops of 3DMoments() - #​1818 via @​kunalspathak, @​brianpopow
• Add sse2 version of inverse transform - #​1819 via @​brianpopow, @​JimBobSquarePants
• Add AVX version of CollectColorBlueTransforms and CollectColorRedTransforms - #​1824 via @​brianpopow, @​JimBobSquarePants
• Add AVX version of TransformColor and TransformColorInverse - #​1830 via @​brianpopow, @​JimBobSquarePants
• Webp improvements - #​1846 via @​brianpopow
• Jpeg new IDCT & fused zigzag/transpose steps - #​1847 via @​br3aker, @​JimBobSquarePants
• Add AVX2 version of AddVector - #​1849 via @​brianpopow
• Add SSE41 version of UpSample - #​1836 via @​brianpopow, @​JimBobSquarePants
• Add AVX2 versions of CombinedShannonEntropy - #​1848 via @​brianpopow
• Add SSE2 version of FTransform - #​1852 via @​brianpopow, @​JimBobSquarePants
• Add AVX2 version of Vp8_Sse4X4 - #​1860 via @​brianpopow
• Jpeg codebase cleanup - #​1853 via @​br3aker
• Add AVX2 version of QuantizeBlock - #​1857 via @​brianpopow, @​JimBobSquarePants
• Add SSE2 version of TransformOne and TransformTwo - #​1862 via @​brianpopow, @​JimBobSquarePants
• Add SSE2 version for webp Filter methods - #​1871 via @​brianpopow, @​JimBobSquarePants
• Add AVX2 version of CollectHistogram - #​1882 via @​brianpopow
• Add SSE2 and AVX2 versions of Vp8_Sse16X16 and Vp8_Sse16X8 - #​1881 via @​brianpopow, @​JimBobSquarePants
• Add AVX2 version of GetResidualCost and SSE2 version of SetCoeffs - #​1902 via @​brianpopow
• SSE2 / AVX2 of webp AlphaDecoding - #​1930 via @​brianpopow, @​JimBobSquarePants
• Jpeg encoder optimization via removing second transpose call from FDCT - #​1958 via @​br3aker

Bug

• Fix gaussian blurring changing the blur colour when transperancy is used - #​1834 via @​Turnerj
• Make ColorDistanceCache non-readonly - #​1841 via @​antonfirsov, @​JimBobSquarePants
• Use Rgb24 for Async Jpeg Decode - #​1859 via @​JimBobSquarePants
• Fix Color conversion for differing types - #​1865 via @​JimBobSquarePants
• Allocate clean buffer in AnalyzeEntropy - #​1873 via @​brianpopow
• Fixed jpeg encoder last bytes flushing bug - #​1876 via @​br3aker
• Tiff: Add maximum IFD threshold - #​1892 via @​brianpopow
• Fixed Jpeg IDCT missing scalar implementation - #​1922 via @​br3aker
• Don't throw when Position is out of range. - #​1907 via @​JimBobSquarePants
• Jpeg ArgumentException fix - #​1924 via @​br3aker
• EXIF IDF pointer - #​1923 via @​IldarKhayrutdinov
• Fix for Jpeg Metadata Decoding with unknown APP13 profile - #​1931 via @​mkehoe, @​JimBobSquarePants
• Only attempt to decode the first JFIF marker instance - #​1933 via @​JimBobSquarePants
• Fix for issue #​1942 - #​1944 via @​brianpopow
• Ensure ResizeProcessor working buffer is contiguous - #​1947 via @​antonfirsov
• Correctly handle identity transforms with varying dimensions - #​1945 via @​JimBobSquarePants
• [EXIF] Support UCS2 and 8-byte encoded string tags - #​1935 via @​IldarKhayrutdinov, @​JimBobSquarePants
• Fixed decoding grayscale jpegs with exotic sampling factors - #​1979 via @​br3aker, @​JimBobSquarePants
• Fixed decoding grayscale jpegs with exotic sampling factors - #​1979 via @​br3aker, @​JimBobSquarePants

Codequality

• Collapse AsSpan().Slice(..) calls into AsSpan(..) - #​1815 via @​turbedi, @​brianpopow

Enhancement

• Support High Precision TPixel formats via Color - Boxed - #​1801 via @​JimBobSquarePants
• Convert OrientationMode into something usable. - #​1976 via @​JimBobSquarePants, @​dlemstra

Formats:Jpeg

• Automatic SSE color converters based on Vector API - #​1864 via @​br3aker, @​brianpopow, @​JimBobSquarePants

Formats:Png

• PNG: Verify CRC of IDAT chunk is correct - #​1898 via @​brianpopow
• Added support for loading exif data from PNG "Raw profile type exif" text chunk - #​1877 via @​jubilant-enigma, @​JimBobSquarePants

Formats:Webp

• Use Span in GetHTreeGroupForPos to avoid allocations - #​1793 via @​brianpopow
• Write exif profile with padding if needed - #​1798 via @​brianpopow
• Use helper methods to access clip tables - #​1803 via @​brianpopow
• Webp encoding: Reduce allocations. - #​1799 via @​brianpopow
• Make sure magick.net and imagesharp use the same configuration for webp encoding - #​1808 via @​brianpopow, @​JimBobSquarePants
• Webp encoder now defaults to lossy, if nothing else is specified - #​1961 via @​brianpopow
• Add support for encoding lossy webp images with alpha channels - #​1971 via @​brianpopow

Other

• Add "decode to target size" skia variant to benchkarks - #​1789 via @​antonfirsov
• Support executing benchmarks on arm64 - #​1794 via @​kunalspathak, @​JimBobSquarePants
• stackalloc header buffer in InternalDetectFormat - #​1812 via @​antonfirsov
• Some minor optimizations - #​1828 via @​turbedi
• Delete outdated benchmark.sh - #​1833 via @​antonfirsov
• Unified jpeg benchmark - #​1844 via @​br3aker
• Jpeg decoder mcu size fix - #​1845 via @​br3aker
• Remove QA from config [skip ci] - #​1893 via @​JimBobSquarePants
• Jpeg sampling factor validation #​1894 - #​1899 via @​br3aker, @​JimBobSquarePants
• Speed up DangerousGetRowSpan(y) - #​1901 via @​antonfirsov
• Remove return value documentation for void return types. - #​1915 via @​wischi-chr
• Jpeg HuffmanTable improvements - #​1926 via @​br3aker, @​JimBobSquarePants
• Support for XMP metadata - #​1918 via @​ynse01, @​JimBobSquarePants
• Add basic memory diagnostic API - #​1969 via @​antonfirsov, @​JimBobSquarePants
• Add tiff and webp to the PackageTags - #​1977 via @​brianpopow, @​dlemstra

Unit Tests

• Skip tests on none Sse2/Avx hardware - #​1785 via @​brianpopow
• Use Convert.To after rounding in Pack() to avoid different behavior on ARM vs x86/x64 - #​1790 via @​brianpopow
• Remove RunSerial from tests - #​1885 via @​brianpopow, @​JimBobSquarePants
• Move RentReturnRelease_SubsequentRentReturnsDifferentHandles out of process - #​1960 via @​antonfirsov
• Disable RentReturnRelease_SubsequentRentReturnsDifferentHandles on Mac again - #​1970 via @​antonfirsov
• Fixed IDisposable leaks in jpeg decoder test suite. - #​1974 via @​br3aker

New Contributors

• @​UltraNamahage made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1574
• @​ynse01 made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1586
• @​saucecontrol made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1601
• @​TechnologicalPizza made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1630
• @​br3aker made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1629
• @​tompazourek made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1691
• @​stephentoub made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1707
• @​synercoder made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1766
• @​kunalspathak made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1794
• @​turbedi made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1815
• @​justinbhopper made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1856
• @​wischi-chr made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1915
• @​jubilant-enigma made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1877
• @​mkehoe made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1931
• @​jz5 made their first contribution in https://github.com/SixLabors/ImageSharp/pull/1929

Full Changelog: SixLabors/ImageSharp@v1.0.4...v2.0.0

v1.0.4

Advisories and Breaking Changes

• None

Release Notes

Bug Fixes

• Fix a few uses of DeflateStream.Read - #​1707 via @​stephentoub

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.