Gap-Dev

Name of the Vulnerable Software and Affected Versions: ImageMagick versions prior to 7.1.2-0 Description: ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 experience infinite lines during a specific XMP file conversion command when writing. Recommendations: Update to version 7.1.2-0 or later.

The issue concerns a denial of service (DOS) vulnerability in the TTF parser of the PDFio library. Maliciously crafted TTF files can cause the program to utilize 100% of the memory and enter an infinite loop, potentially leading to a heap-buffer-overflow vulnerability. This occurs due to the `nGroups` value extracted from the file, which, when altered, can cause the program to consume excessive memory and enter an infinite loop. The `read camp` function is specifically affected by this issue. Automated systems, including web servers using this library to convert PDF submissions into plaintext, are vulnerable to DOS attacks if an attacker uploads a malicious TTF file.

The issue is related to the es5-ext package, which contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTokens` may cause the script to stall. This can lead to a denial of service.

The issue is a memory overflow vulnerability in OpenEXR-viewer, a viewer for OpenEXR files with detailed metadata probing. This vulnerability is fixed in version 0.6.1.

The issue is related to a Prototype Pollution vulnerability in the `setByPath` function, which can lead to remote code execution (RCE). This vulnerability allows an attacker to modify object attributes, potentially enabling them to execute arbitrary code. The vulnerability is present in versions prior to 1.0.2 of the dot-diver library.

The issue is related to a regular expression denial of service (redos) vulnerability in the get-func-name module, which can lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, resulting in excessive backtracking and increased CPU load and processing time. The vulnerability can be triggered using a specific input, such as `'t'.repeat(54773) + 't/function/i'`. The regex implementation in question is susceptible to excessive backtracking, leading to potential DoS attacks.