{"schemaVersion":3,"id":"CVE-2023-36308","aliases":["DEBIAN-CVE-2023-36308","CGA-3grj-f245-m7xh","CGA-mch5-r5hj-2792","GHSA-q7pp-wcgr-pffx","CGA-5937-6x2x-q54w","CGA-85vf-38fg-j29f","CGA-85wq-2x3g-c78j","CGA-8659-4fp4-wc42","CGA-c8qh-264x-qr59","CGA-j8p6-53mc-9j8r","CGA-qg85-x8ww-42p5","CGA-qxqf-rm3p-9h54","CGA-v4fr-7xxf-j7mx","CGA-wgw9-9qjg-83rq","CGA-wj6v-g499-xc2v","CGA-xvvp-2wff-q77q","CGA-p63h-jp68-h9f2","CGA-r7jh-jqh8-r962"],"status":"published","duplicateOf":null,"title":null,"description":"disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a crafted TIFF file to the scan function of scanner.go. NOTE: it is unclear whether there are common use cases in which this panic could have any security consequence","dates":{"published":"2023-09-05T00:00:00.000Z","modified":"2025-11-04T17:12:35.101Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","exploitability":4.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00385,"percentile":0.31296,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00385},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00385,"percentile":0.31296}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00385,"percentile":0.31296}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_DISINTEGRATION_IMAGING","name":"Imaging","source":"github","url":"https://github.com/disintegration/imaging/issues/165","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-129","name":"Improper Validation of Array Index","description":"The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/129.html"}],"affected":[{"vendor":"chainguard","product":"filebrowser","name":"filebrowser","label":"filebrowser","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/filebrowser","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"listmonk","name":"listmonk","label":"listmonk","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/listmonk","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo","name":"nemo","label":"nemo","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-gym","name":"nemo-gym","label":"nemo-gym","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-gym","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-rl-cuda-13.0","name":"nemo-rl-cuda-13.0","label":"nemo-rl-cuda-13.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-rl-cuda-13.0-automodel","name":"nemo-rl-cuda-13.0-automodel","label":"nemo-rl-cuda-13.0-automodel","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0-automodel","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-rl-cuda-13.0-mcore","name":"nemo-rl-cuda-13.0-mcore","label":"nemo-rl-cuda-13.0-mcore","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0-mcore","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-rl-cuda-13.0-sglang","name":"nemo-rl-cuda-13.0-sglang","label":"nemo-rl-cuda-13.0-sglang","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0-sglang","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-rl-cuda-13.0-vllm","name":"nemo-rl-cuda-13.0-vllm","label":"nemo-rl-cuda-13.0-vllm","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0-vllm","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-skills","name":"nemo-skills","label":"nemo-skills","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-skills","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"seaweedfs-operator","name":"seaweedfs-operator","label":"seaweedfs-operator","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/seaweedfs-operator","purlType":"apk","versions":[{"text":"< 1.0.6-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.0.6-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"seaweedfs-operator-fips","name":"seaweedfs-operator-fips","label":"seaweedfs-operator-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/seaweedfs-operator-fips","purlType":"apk","versions":[{"text":"< 1.0.6-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.0.6-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"filebrowser","name":"filebrowser","label":"filebrowser","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/filebrowser","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"debian","product":"golang-github-disintegration-imaging","name":"golang-github-disintegration-imaging","label":"golang-github-disintegration-imaging","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/golang-github-disintegration-imaging","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 1.6.2-3","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 1.6.2-3","eol":null,"hubHref":null},{"vendor":"disintegration","product":"imaging","name":"imaging","label":"imaging","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.6.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.6.2","eol":null,"hubHref":"/vendor/disintegration/imaging"},{"vendor":"github.com/disintegration","product":"imaging","name":"github.com/disintegration/imaging","label":"imaging","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/disintegration/imaging","purlType":"golang","versions":[{"text":"≤ 1.6.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.6.2","eol":null,"hubHref":null}],"affectedCount":16,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/disintegration/imaging/releases/tag/v1.6.2","label":"github.com/disintegration/imaging/releases/tag/v1.6.2","hostname":"github.com","tags":["WEB","Release Notes"]},{"url":"https://github.com/disintegration/imaging/issues/165","label":"github.com/disintegration/imaging/issues/165","hostname":"github.com","tags":["WEB","Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GX2SYGRCNFUAGELLDOBIERCSCYSGKFY/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3GX2SYGRCNFUAGELLDOBIERCSCYSGKFY/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":[]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-36308","label":"security-tracker.debian.org/tracker/CVE-2023-36308","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36308","label":"nvd.nist.gov/vuln/detail/CVE-2023-36308","hostname":"nvd.nist.gov","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-2CHR-2W27-9RX5","CGA-2VMG-P6FX-FV7M","CGA-9PJX-RGPC-FWM7","CGA-QFG2-8X8P-3R2M","CVE-2024-24792"]},"timeline":[{"kind":"published","date":"2023-09-05T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-11-04T17:12:35.101Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T16:57:09.253Z","stale":false,"partial":false}}