Magick.NET 14.10.3 Security Update: Fixes Heap Overflow, DoS, and Policy Bypass Vulnerabilities

Thinking Process: 1. Analyze the Request: Task: Translate a Chinese vulnerability intelligence summary to English. Role: Professional translator specializing in cybersecurity. Constraint 1: Maintain all Markdown formatting intact. Constraint 2: Do not add any introductory or concluding remarks. Input: A text describing vulnerability information extracted from a webpage screenshot regarding Magick.NET version 14.10.3. Output: English translation only. 2. Analyze the Input Text: Header: "从这个网页截图中可以获取到关于Magick.NET版本14.10.3的关键漏洞信息如下：" (From this webpage screenshot, the following key vulnerability information about Magick.NET version 14.10.3 can be obtained:) Section 1: "修复的漏洞列表：" (List of Fixed Vulnerabilities:) List Items: A long list of specific vulnerabilities with GHSA IDs and descriptions. These need accurate technical translation. Section 2: "更新的库列表，包括ImageMagick、gdk-pixbuf、harfbuzz等及其更新日期。" (List of Updated Libraries, including ImageMagick, gdk-pixbuf, harfbuzz, etc., and their update dates.) Footer: "这些信息指向了该版本Magick.NET修复的一系列安全漏洞和性能优化，有助于开发者了解此版本更新的重要性，并及时升级以避免潜在的安全风险。" (This information points to a series of security vulnerabilities and performance optimizations fixed in this version of Magick.NET, helping developers understand the importance of this version update and upgrade in time to avoid potential security risks.) 3. Drafting the Translation (Iterative Process): Header: From this webpage screenshot, the following key vulnerability information regarding Magick.NET version 14.10.3 can be obtained: Section 1: List of Fixed Vulnerabilities: List Items: OpenCL initialization issue (#1954) -> OpenCL initialization issue (#1954) WaveletDenoise中的堆缓冲区溢出问题（GHSA-qpgx-jfcq-r59f） -> Heap buffer overflow in WaveletDenoise (GHSA-qpgx-jfcq-r59f) 使用jpeg:extent时JPEG编码器中的可能无限循环（GHSA-gwr3-x37h-h84q） -> Potential infinite loop in JPEG encoder when using jpeg:extent (GHSA-gwr3-x37h-h84q) 写入IPTCTEXT时导致的无限循环，可通过构造文件触发（GHSA-v994-63cq-9wj3） -> Infinite loop caused by writing IPTCTEXT, triggerable via crafted files (GHSA-v994-63cq-9wj3) 无效的MSL导致的use after free问题（GHSA-w8mw-frc6-r7m8） -> Use-after-free issue caused by invalid MSL (GHSA-w8mw-frc6-r7m8) DJVU解码器中的越界读取（GHSA-r99p-5442-q2x2） -> Out-of-bounds read in DJVU decoder (GHSA-r99p-5442-q2x2) 内部SVG解码器中的无限制过多内存分配（GHSA-v7q2-m8c5-mf84） -> Unrestricted excessive memory allocation in internal SVG decoder (GHSA-v7q2-m8c5-mf84) 内部SVG解码器中的整数溢出或错误转换（GHSA-7355-pwx2-pmw4） -> Integer overflow or incorrect conversion in internal SVG decoder (GHSA-7355-pwx2-pmw4) 在32位系统上sun解码器中的堆溢出（GHSA-6j5f-24fw-pqp4） -> Heap overflow in SUN decoder on 32-bit systems (GHSA-6j5f-24fw-pqp4) 各种编码器中的代码注入（GHSA-rw6c-xp26-225vj） -> Code injection in various encoders (GHSA-rw6c-xp26-225vj) UIL和XPM写入器中的全局缓冲区溢出（GHSA-vpxv-r9pg-7qpr） -> Global buffer overflow in UIL and XPM writers (GHSA-vpxv-r9pg-7qpr) 写入UHDR图像时通过有符号整数溢出导致的堆缓冲区溢出（GHSA-vhqf-f5cj-9x8h） -> Heap buffer overflow caused by signed integer overflow when writing UHDR images (GHSA-vhqf-f5cj-9x8h) 多次错误/提前返回路径中的水印图像对象内存泄漏（GHSA-g2pr-qxjg-7i2v） -> Memory leak of watermark image object in multiple error/early return paths (GHSA-g2pr-qxjg-7i2v) 销毁图像信息后在ReadSFWImage中的NULL指针引用（GHSA-p33r-fqw2-rqmm） -> NULL pointer reference in ReadSFWImage after destroying image information (GHSA-p33r-fqw2-rqmm) ASHLAR编码器中的潜在内存泄漏（GHSA-p33r-fqw2-rqmm） -> Potential memory leak in ASHLAR encoder (GHSA-p33r-fqw2-rqmm) Note: The GHSA ID is the same as the previous one in the source text, likely a copy-paste error in the original Chinese text, but I must translate faithfully. 路径遍历政策绕过导致即使在安全策略下也能读取受限制内容（GHSA-8jvj-p28h-9gm7） -> Path traversal policy bypass allowing reading of restricted content even under security policies (GHSA-8jvj-p28h-9gm7) 通过config/policy-secure.xml中的“fd handler”绕开安全策略导致stdin/stdout访问（GHSA-xwc6-v6g8-pw2h） -> Security policy bypass via "fd handler" in config/policy-secure.xml leading to stdin/stdout access (GHSA-xwc6-v6g8-pw2h) YUV 4:2:2解码器中的堆缓冲区溢出（GHSA-mqfc-82jx-3mr2） -> Heap buffer overflow in YUV 4:2:2 decoder (GHSA-mqfc-82jx-3mr2) MAP图像解码器中的堆缓冲区读取溢出（GHSA-42p5-62qq-mmh7） -> Heap buffer read overflow in MAP image decoder (GHSA-42p5-62qq-mmh7) 通过构造图像在ClonePixelCacheRepository中的NULL指针引用（GHSA-p863-5fgm-rqq4） -> NULL pointer reference in ClonePixelCacheRepository via crafted images (GHSA-p863-5fgm-rqq4) YUV采样因子验证中的除以零导致崩溃（GHSA-543g-8grm-9cw6） -> Crash caused by division by zero in YUV sampling factor validation (GHSA-543g-8grm-9cw6) 通过过大整数字段在FTXT读取器中的堆栈缓冲区溢出（GHSA-72hf-fj62-w6j4） -> Stack buffer overflow in FTXT reader via oversized integer fields (GHSA-72hf-fj62-w6j4) MSL图像栈索引未刷新导致的泄漏图像（GHSA-782x-jh29-9mf7） -> Leaked images caused by MSL image stack index not being refreshed (GHSA-782x-jh29-9mf7) MSL属性栈缓冲区溢出导致越界写入（GHSA-3mwp-xqv2-q6ph） -> Out-of-bounds write caused by MSL attribute stack buffer overflow (GHSA-3mwp-xqv2-q6ph) MSL编码器中的内存泄漏（GHSA-gxcx-qjqj-8vjw） -> Memory leak in MSL encoder (GHSA-gxcx-qjqj-8vjw) ashlar.c中编码器的内存泄漏（GHSA-xgm3-v4r9-wfgm） -> Memory leak in enco

Goal Reached Thanks to every supporter — we hit 100%!

Magick.NET 14.10.3 Security Update: Fixes Heap Overflow, DoS, and Policy Bypass Vulnerabilities

More from this source