libsixel vulnerabilities

The libsixel library has a signed integer overflow in the image-buffer doubling loop of the SIXEL parser, which can lead to an out-of-bounds heap write. This issue affects versions up to 1.8.7-r1 and is fixed in version 1.8.7-r2.

The libsixel library has a heap buffer overflow due to incorrect allocation size calculation in the sixel_encode_highcolor function. This issue affects versions from 1.8.7-r1 to 1.8.7-r2, where the lack of an upper bound for width and height allows for potential memory overwrites.

In libsixel versions 1.8.7 and prior, built with --with-gdk-pixbuf2, a use-after-free vulnerability exists in load_with_gdkpixbuf(). The cleanup path manually frees the sixel_frame_t object without consulting the reference count, leading to a dangling pointer. An attacker can supply a crafted image, potentially causing information disclosure, memory corruption, or code execution.