Bug 1227168

Summary: VUL-0: CVE-2024-24792: kitty: golang.org/x/image/tiff: parsing of a corrupt or malicious image with invalid color indices can cause a panic
Product: [openSUSE] openSUSE Distribution Reporter: Camila Camargo de Matos <camila.matos>
Component: SecurityAssignee: Scott Bradnick <scott.bradnick>
Status: IN_PROGRESS --- QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: camila.matos, security-team, smash_bz
Version: Leap 15.6   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/412299/
Whiteboard:
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Bug Depends on:    
Bug Blocks: 1227158    

Description Camila Camargo de Matos 2024-06-28 11:39:26 UTC 
+++ This bug was initially created as a clone of Bug #1227158 +++

Parsing a corrupt or malicious image with invalid color indices can cause a panic.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24792
https://www.cve.org/CVERecord?id=CVE-2024-24792
https://go.dev/cl/588115
https://go.dev/issue/67624
https://pkg.go.dev/vuln/GO-2024-2937
Comment 2 Scott Bradnick 2024-06-28 14:54:21 UTC 
https://github.com/kovidgoyal/kitty/commit/3ec06920011b8c5819f2c9fbeebd2334d5c3919d and/or https://github.com/kovidgoyal/kitty/commit/6d206324e0201b22a4c1cf5a687ecc8fb2eaed8c update golang.org/x/image from 0.17.0 -> 0.18.0 and according to https://pkg.go.dev/vuln/GO-2024-2937, this should take care of it.