GHSA-6r2x-8pq8-9489
Electron vulnerable to Heap Buffer Overflow in NativeImage
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2024-46993
- CVSS_V4
- CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Description
### Impact The `nativeImage.createFromPath()` and `nativeImage.createFromBuffer()` functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents. ### Workaround There are no app-side workarounds for this issue. You must update your Electron version to be protected. ### Patches - `v28.3.2` - `v29.3.3` - `v30.0.3` ### For More Information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org).
Paquets affectés
| Paquet | Versions |
|---|---|
| npm · electron | introduced 0, fixed 28.3.2 |
| npm · electron | introduced 29.0.0-alpha.1, fixed 29.3.3 |
| npm · electron | introduced 30.0.0-alpha.1, fixed 30.0.3 |
Références
- https://github.com/electron/electron/security/advisories/GHSA-6r2x-8pq8-9489 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-46993 ADVISORY
- https://github.com/electron/electron PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |