Skip to content

Upgrading SixLabors.ImageSharp 2 to 3

Breaking2.1.13 → 3.2.0Breaking3Security23New36Changed37Fixed87Other51

Full comparisonBack to SixLabors.ImageSharp
BreakingUpgrade verdict

3 breaking changes and 21 security fixes.

In plain terms
  • A rarely used EXIF tag constant is no longer available in the library.
  • Removes obsolete code.
  • Removes ImageFormat out parameters and return values on Metadata.
  • ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
Must act Top 5 of 24 that need code or config changes

Target frameworks requirement changed in 3.0.0: .NETCoreApp2.1, .NETCoreApp3.1, .NETFramework4.7.2, .NETStandard2.0, .NETStandard2.1 → net6.0.

What you must change

Breaking3
Removes ExifTagValue.InteroperabilityIndex.
ExifTagValue.InteroperabilityIndex
3.1.10GitHub ReleaseSummarizedView source
Removes obsolete code.
3.0.0GitHub ReleaseSummarizedView source
Removes ImageFormat out parameters and return values on Metadata.
ImageFormatMetadata
3.0.0GitHub ReleaseSummarizedView source
Security21
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
High · CVSS 7.5
3.2.0GitHub AdvisoryOriginalView source
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
High · CVSS 7.5
3.2.0GitHub AdvisoryOriginalView source
ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
High · CVSS 7.5
3.2.0GitHub AdvisoryOriginalView source
ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop
Moderate · CVSS 5.3
3.2.0GitHub AdvisoryOriginalView source
ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
Moderate · CVSS 5.3
3.2.0GitHub AdvisoryOriginalView source
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
High · CVSS 7.5
3.2.0GitHub AdvisoryOriginalView source
SixLabors ImageSharp Has Infinite Loop in GIF Decoder When Skipping Malformed Comment Extension Blocks
Moderate · CVSS 5.3
3.1.11GitHub AdvisoryOriginalView source
Out-of-bounds Write in SixLabors ImageSharp
High · CVSS 7.5
3.1.7GitHub AdvisoryOriginalView source
Fixes a buffer overrun (backport of fix for #2779).
3.1.6GitHub ReleaseSummarizedView source
SixLabors ImageSharp Out-of-bounds Write
GifHigh · CVSS 7.5
3.1.5GitHub AdvisoryOriginalView source
SixLabors ImageSharp has Excessive Memory Allocation in Gif Decoder
Moderate · CVSS 5.3
3.1.5GitHub AdvisoryOriginalView source
Limits read palette indices to prevent out-of-range access.
3.1.4GitHub ReleaseSummarizedView source
Limits all memory allocations in the MemoryAllocator layer.
MemoryAllocator
3.1.4GitHub ReleaseSummarizedView source
Clears pixel buffers on decode to avoid leaking stale memory contents.
3.1.4GitHub ReleaseSummarizedView source
SixLabors.ImageSharp vulnerable to data leakage
Moderate · CVSS 5.3
3.1.4GitHub AdvisoryOriginalView source
SixLabors.ImageSharp vulnerable to Memory Allocation with Excessive Size Value
Moderate · CVSS 5.3
3.1.4GitHub AdvisoryOriginalView source
Limits ancillary PNG chunk size.
3.1.3GitHub ReleaseSummarizedView source
Use After Free in SixLabors.ImageSharp
High · CVSS 7.1
3.1.3GitHub AdvisoryOriginalView source
Prevents a crafted denial of service attack.
3.1.0GitHub ReleaseSummarizedView source
Handles EOF in the JPEG bit reader when data is bad to prevent a DOS attack.
3.1.0GitHub ReleaseSummarizedView source
Handles EOF in the Jpeg bit reader when data is bad to prevent a DOS attack.
3.0.2GitHub ReleaseSummarizedView source