Bug 1227168 - VUL-0: CVE-2024-24792: kitty: golang.org/x/image/tiff: parsing of a corrupt or malicious image with invalid color indices can cause a panic
Summary: VUL-0: CVE-2024-24792: kitty: golang.org/x/image/tiff: parsing of a corrupt o...
Status: IN_PROGRESS
Alias: None
Product: openSUSE Distribution
Classification: openSUSE
Component: Security (show other bugs)
Version: Leap 15.6
Hardware: Other Other
: P3 - Medium : Normal (vote)
Target Milestone: ---
Assignee: Scott Bradnick
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/412299/
Whiteboard:
Keywords:
Depends on:
Blocks: CVE-2024-24792
  Show dependency tree / graph
 
Reported: 2024-06-28 11:39 UTC by Camila Camargo de Matos
Modified: 2024-06-28 14:54 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Camila Camargo de Matos 2024-06-28 11:39:26 UTC 
+++ This bug was initially created as a clone of Bug #1227158 +++

Parsing a corrupt or malicious image with invalid color indices can cause a panic.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24792
https://www.cve.org/CVERecord?id=CVE-2024-24792
https://go.dev/cl/588115
https://go.dev/issue/67624
https://pkg.go.dev/vuln/GO-2024-2937
Comment 2 Scott Bradnick 2024-06-28 14:54:21 UTC 
https://github.com/kovidgoyal/kitty/commit/3ec06920011b8c5819f2c9fbeebd2334d5c3919d and/or https://github.com/kovidgoyal/kitty/commit/6d206324e0201b22a4c1cf5a687ecc8fb2eaed8c update golang.org/x/image from 0.17.0 -> 0.18.0 and according to https://pkg.go.dev/vuln/GO-2024-2937, this should take care of it.