Router0Mail

**Name of the Vulnerable Software and Affected Versions** Imager for Perl versions prior to 1.036 **Description** Reading a paletted image with pixel indexes that exceed its colour map in the `i gpix p()` and `i glin p()` functions leads to the disclosure of uninitialised heap memory. The TGA reader stores pixel indexes without validating them against the colour map. In `i gpix p()`, an index equal to the count reads the first unpopulated entry, which is then returned by `getpixel()`. In `i glin p()`, the palette-to-RGB conversion process utilizes an uninitialised buffer, causing pixels in the converted image to contain previous heap contents. An attacker can disclose process heap memory by providing a malicious image via `Imager->read()` and subsequently fetching its pixels or converting the image to RGB. **Recommendations** Update to version 1.036 or later.

**Name of the Vulnerable Software and Affected Versions** Imager for Perl versions prior to 1.036 **Description** Processing a TGA file with a colour map length of 32768 or more triggers an uncatchable process exit when using the `Imager->read()` function. This occurs because the reader unpacks the two-byte colour map length into a signed short, causing values of 32768 or more to be interpreted as negative. The `tga palette read()` function then casts this negative value to `size t`, leading `mymalloc()` to request an excessively large memory allocation near `SIZE MAX`. When this allocation fails, the allocator calls `exit(3)`, terminating the process. **Recommendations** Update Imager for Perl to version 1.036 or later.