基础信息
项目名称：JetBrains/Nitra
项目徽章：
仓库地址：https://github.com/pterodactyl/panel
检测报告地址：https://www.murphysec.com/console/report/1721305653665681408/1732061597830438912
此报告由Murphysec提供
漏洞列表
| 漏洞名称 | 漏洞类型 | MPS编号 | CVE编号 | 漏洞等级 |
|---|---|---|---|---|
| libpng’ Graphics Library PNG_SET_SPLT远程拒绝服务攻击漏洞 | 输入验证不恰当 | MPS-2006-5624 | CVE-2006-5793 | 低危 |
| Libpng库远程拒绝服务漏洞 | 输入验证不恰当 | MPS-2007-2804 | CVE-2007-2445 | 中危 |
| Libpng库ICC配置文件 ‘pngset.c’文件块单字节错误拒绝服务漏洞 | 数字错误 | MPS-2007-5240 | CVE-2007-5266 | 中危 |
| Libpng库ICC配置文件 ‘pngset.c’文件块单字节错误拒绝服务漏洞 | 数字错误 | MPS-2007-5241 | CVE-2007-5267 | 中危 |
| Libpng库pngtrtran.c文件远程拒绝服务漏洞 | 拒绝服务 | MPS-2007-5242 | CVE-2007-5268 | 中危 |
| Libpng库pngtrtran.c文件远程拒绝服务漏洞 | 输入验证不恰当 | MPS-2007-5243 | CVE-2007-5269 | 中危 |
| Libpng库未知类型块处理远程代码执行漏洞 | 数字错误 | MPS-2008-1702 | CVE-2008-1382 | 高危 |
| 开源软件 libpng 多个 拒绝服务漏洞 | Off-by-one错误 | MPS-2008-3827 | CVE-2008-3964 | 中危 |
| libpng 未明漏洞 | 空指针取消引用 | MPS-2009-0180 | CVE-2008-5907 | 中危 |
| Libpng库png_handle_tEXt()内存泄露漏洞 | 资源管理错误 | MPS-2009-0930 | CVE-2008-6218 | 高危 |
| Libpng库1位隔行图形信息泄露漏洞 | 未授权敏感信息泄露 | MPS-2009-2868 | CVE-2009-2042 | 中危 |
| Libpng png_decompress_chunk()函数拒绝服务漏洞 | 拒绝服务 | MPS-2010-0647 | CVE-2010-0205 | 中危 |
| libpng内存破坏和拒绝服务漏洞 | 经典缓冲区溢出 | MPS-2010-2527 | CVE-2010-1205 | 严重 |
| libpng 资源管理错误漏洞 | 内存泄漏 | MPS-2010-2545 | CVE-2010-2249 | 中危 |
| libpng PNG图像缓冲区溢出漏洞 | 缓冲区溢出 | MPS-2011-0186 | CVE-2011-0408 | 中危 |
| libpng pngerror.c png_format_buffer函数设计错误漏洞 | 越界读取 | MPS-2011-2140 | CVE-2011-2501 | 中危 |
| libpng缓冲区错误漏洞 | 经典缓冲区溢出 | MPS-2011-2141 | CVE-2011-2690 | 高危 |
| libpng pngerror.c png_err函数拒绝服务漏洞 | 空指针取消引用 | MPS-2011-2142 | CVE-2011-2691 | 中危 |
| libpng pngrutil.c png_handle_sCAL函数缓冲区错误漏洞 | 缓冲区溢出 | MPS-2011-2143 | CVE-2011-2692 | 高危 |
| libpng pngwutil.c内存泄露漏洞 | 内存泄漏 | MPS-2011-2629 | CVE-2009-5063 | 中危 |
| libpng pngwutil.c内存泄露漏洞 | 资源管理错误 | MPS-2011-2630 | CVE-2006-7244 | 中危 |
| libpng 安全漏洞 | 拒绝服务 | MPS-2012-0103 | CVE-2011-3328 | 低危 |
| libpng ‘png_inflate()’ 缓冲区错误漏洞 | 整数溢出或环绕 | MPS-2012-0999 | CVE-2011-3045 | 中危 |
| libpng png_set_text_2() 内存破坏漏洞 | 缓冲区溢出 | MPS-2012-1700 | CVE-2011-3048 | 中危 |
| Libpng14 拒绝服务漏洞 | 缓冲区溢出 | MPS-2012-2821 | CVE-2012-3425 | 中危 |
| libpng png_do_expand_palette 函数空指针逆向引用拒绝服务漏洞 | 拒绝服务 | MPS-2014-0128 | CVE-2013-6954 | 中危 |
| libpng png_push_read_chunk 函数安全漏洞 | 数字错误 | MPS-2014-0977 | CVE-2014-0333 | 中危 |
| libpng 整数溢出漏洞 | 数字错误 | MPS-2014-2273 | CVE-2013-7353 | 中危 |
| libpng 数字错误漏洞 | 数字错误 | MPS-2014-2274 | CVE-2013-7354 | 中危 |
| libpng 基于堆的缓冲区溢出漏洞 | 缓冲区溢出 | MPS-2015-0181 | CVE-2014-9495 | 严重 |
| libpng 基于堆的缓冲区溢出漏洞 | 缓冲区溢出 | MPS-2015-0388 | CVE-2015-0973 | 高危 |
| libpng 缓冲区错误漏洞 | 经典缓冲区溢出 | MPS-2015-5791 | CVE-2015-8126 | 高危 |
| libpng png_convert_to_rfc1123() 函数内存损坏漏洞 | 未授权敏感信息泄露 | MPS-2015-5896 | CVE-2015-7981 | 中危 |
| libpng 缓冲区错误漏洞 | 缓冲区溢出 | MPS-2016-0563 | CVE-2015-8472 | 高危 |
| libpng‘pngwutil.c’整数溢出漏洞 | 数字错误 | MPS-2016-1691 | CVE-2015-8540 | 高危 |
| Android libpng 提权漏洞 | 输入验证不恰当 | MPS-2016-3291 | CVE-2016-3751 | 高危 |
| libpng 安全漏洞 | 空指针取消引用 | MPS-2017-1020 | CVE-2016-10087 | 高危 |
| libpng 数字错误漏洞 | 除零错误 | MPS-2018-9315 | CVE-2018-13785 | 中危 |
| libpng 安全漏洞 | 输入验证不恰当 | MPS-2018-9648 | CVE-2018-14048 | 中危 |
| libpng 资源管理错误漏洞 | UAF | MPS-2019-1241 | CVE-2019-7317 | 中危 |
| libpng 缓冲区错误漏洞 | 越界写入 | MPS-2019-7748 | CVE-2018-14550 | 高危 |
| libpng 输入验证错误漏洞 | 输入验证不恰当 | MPS-2019-7770 | CVE-2017-12652 | 严重 |
| Expat 资源管理错误漏洞 | 数值计算不正确 | MPS-2022-0004 | CVE-2021-45960 | 高危 |
| Expat 输入验证错误漏洞 | 整数溢出或环绕 | MPS-2022-0825 | CVE-2022-22823 | 严重 |
| libpng 缓冲区错误漏洞 | 经典缓冲区溢出 | MPS-2022-2557 | CVE-2021-4214 | 中危 |
| Expat 资源管理错误漏洞 | 未经控制的递归 | MPS-2022-4399 | CVE-2022-25313 | 中危 |
| libexpat 资源管理错误漏洞 | UAF | MPS-2022-60795 | CVE-2022-43680 | 高危 |
| libpng 代码问题漏洞 | 空指针取消引用 | MPS-2022-63559 | CVE-2022-3857 | 中危 |
缺陷组件
| 组件名称 | 版本 | 最小修复版本 | 依赖关系 | 修复建议 |
|---|---|---|---|---|
| libexpat | 2.0.1 | 间接依赖 | 建议修复 | |
| libexpat | 1.95.5 | 间接依赖 | 建议修复 | |
| libpng | 1.4.0 | 1.6.39 | 间接依赖 | 建议修复 |
| libpng | 1.2.12 | 1.6.39 | 间接依赖 | 建议修复 |
许可证风险
| 许可证类型 | 相关组件 | 许可证风险 |
|---|---|---|
| non-standard | 4 | 低 |
| Zlib | 1 | 低 |
SBOM清单
| 组件名称 | 组件版本 | 是否直接依赖 | 仓库 |
|---|---|---|---|
| System.Runtime.Numerics | 4.0.1 | 间接依赖 | nuget |
| System.Text.Encoding.Extensions | 4.0.11 | 间接依赖 | nuget |
| Rx-Core | 2.2.5 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Shell.Interop.8.0 | 8.0.50727 | 间接依赖 | nuget |
| libpng | 1.2.12 | 间接依赖 | |
| stdole | 7.0.3301 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Text.UI | 15.0.26201 | 间接依赖 | nuget |
| VSSDK.TextManager.Interop | 7.0.4 | 间接依赖 | nuget |
| VSSDK.DTE | 7.0.4 | 间接依赖 | nuget |
| libglib-2.0-0.dll | 间接依赖 | ||
| System.Resources.ResourceManager | 4.0.0 | 间接依赖 | nuget |
| iconv.dll | 间接依赖 | ||
| libgdk_pixbuf-2.0-0.dll | 间接依赖 | ||
| Microsoft.VisualStudio.Imaging | 15.0.26201 | 间接依赖 | nuget |
| libpng | 1.4.0 | 间接依赖 | |
| GDI32.dll | 间接依赖 | ||
| Microsoft.VisualStudio.Imaging | 14.3.25407 | 间接依赖 | nuget |
| USER32.dll | 间接依赖 | ||
| System.Text.RegularExpressions | 4.1.0 | 间接依赖 | nuget |
| SHELL32.DLL | 间接依赖 | ||
| VSSDK.IDE | 7.0.4 | 间接依赖 | nuget |
| libexpat.dll | 间接依赖 | ||
| System.Reactive.Interfaces | 3.1.1 | 间接依赖 | nuget |
| VSSDK.Threading.12 | 12.0.4 | 间接依赖 | nuget |
| System.Diagnostics.Debug | 4.0.11 | 间接依赖 | nuget |
| AvalonEdit | 4.2.0.8783 | 间接依赖 | nuget |
| System.Globalization | 4.0.11 | 间接依赖 | nuget |
| VSLangProj2 | 7.0.5000 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Imaging.Interop.14.0.DesignTime | 14.3.25407 | 间接依赖 | nuget |
| System.Runtime | 4.1.0 | 间接依赖 | nuget |
| libgthread-2.0-0.dll | 间接依赖 | ||
| ReactiveUI.Fody | 1.1.51 | 间接依赖 | nuget |
| VSSDK.Settings.12 | 12.0.4 | 间接依赖 | nuget |
| System.Diagnostics.Tracing | 4.1.0 | 间接依赖 | nuget |
| IMM32.DLL | 间接依赖 | ||
| System.Xml.ReaderWriter | 4.0.11 | 间接依赖 | nuget |
| VSLangProj | 7.0.3300 | 间接依赖 | nuget |
| Microsoft.VisualStudio.TextManager.Interop.8.0 | 8.0.50727 | 间接依赖 | nuget |
| libgobject-2.0-0.dll | 间接依赖 | ||
| System.Threading | 4.0.0 | 间接依赖 | nuget |
| Rx-Linq | 2.2.5 | 间接依赖 | nuget |
| msvcrt.dll | 间接依赖 | ||
| Microsoft.VisualStudio.Text.UI.Wpf | 15.0.26201 | 间接依赖 | nuget |
| libexpat | 1.95.5 | 间接依赖 | |
| libgmodule-2.0-0.dll | 间接依赖 | ||
| Microsoft.VisualStudio.Utilities | 14.3.25407 | 间接依赖 | nuget |
| System.Security.Cryptography.Primitives | 4.3.0 | 间接依赖 | nuget |
| System.Net.Http | 4.3.1 | 间接依赖 | nuget |
| GLU32.dll | 间接依赖 | ||
| OLE32.dll | 间接依赖 | ||
| libfreetype-6.dll | 间接依赖 | ||
| intl.dll | 间接依赖 | ||
| KERNEL32.dll | 间接依赖 | ||
| System.Linq | 4.1.0 | 间接依赖 | nuget |
| libpng12.dll | 间接依赖 | ||
| VSSDK.Data | 12.0.4 | 间接依赖 | nuget |
| VSSDK.Shell.Immutable.10 | 10.0.4 | 间接依赖 | nuget |
| Microsoft.VisualStudio.CoreUtility | 15.0.26201 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Threading | 15.0.240 | 间接依赖 | nuget |
| libcairo-2.dll | 间接依赖 | ||
| GLU32.DLL | 间接依赖 | ||
| System.Security.Cryptography.X509Certificates | 4.3.0 | 间接依赖 | nuget |
| EnvDTE80 | 8.0.1 | 间接依赖 | nuget |
| System.ObjectModel | 4.0.12 | 间接依赖 | nuget |
| WS2_32.DLL | 间接依赖 | ||
| OPENGL32.DLL | 间接依赖 | ||
| NETStandard.Library | 1.6.0 | 间接依赖 | nuget |
| EnvDTE | 8.0.1 | 间接依赖 | nuget |
| Splat | 1.6.2 | 间接依赖 | nuget |
| NUnit | 2.6.4 | 间接依赖 | nuget |
| VSSDK.IDE.12 | 12.0.4 | 间接依赖 | nuget |
| libatk-1.0-0.dll | 间接依赖 | ||
| ltdl.dll | 间接依赖 | ||
| Microsoft.VisualStudio.Utilities | 15.0.26201 | 间接依赖 | nuget |
| System.Runtime.Extensions | 4.0.0 | 间接依赖 | nuget |
| EnvDTE90a | 9.0.1 | 间接依赖 | nuget |
| System.Diagnostics.Contracts | 4.0.1 | 间接依赖 | nuget |
| System.Reflection.Extensions | 4.0.1 | 间接依赖 | nuget |
| EnvDTE100 | 10.0.1 | 间接依赖 | nuget |
| mscoree.dll | 间接依赖 | ||
| Microsoft.VisualStudio.Shell.Immutable.14.0 | 14.3.25407 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Language.NavigateTo.Interfaces | 15.0.26201 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Shell.Immutable.11.0 | 11.0.50727 | 间接依赖 | nuget |
| System.Collections.Concurrent | 4.0.12 | 间接依赖 | nuget |
| System.IO | 4.1.0 | 间接依赖 | nuget |
| Rx-Main | 2.2.5 | 间接依赖 | nuget |
| MSVCR90.dll | 间接依赖 | ||
| Microsoft.Tpl.Dataflow | 4.5.24 | 间接依赖 | nuget |
| libgdkglext-win32-1.0-0.dll | 间接依赖 | ||
| System.Linq.Expressions | 4.1.0 | 间接依赖 | nuget |
| System.Text.Encoding | 4.0.11 | 间接依赖 | nuget |
| System.Net.Primitives | 4.0.11 | 间接依赖 | nuget |
| System.ComponentModel | 4.0.1 | 间接依赖 | nuget |
| SHLWAPI.DLL | 间接依赖 | ||
| VSSDK.CoreUtility | 12.0.4 | 间接依赖 | nuget |
| System.Resources.ResourceManager | 4.0.1 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Shell.Interop.9.0 | 9.0.30729 | 间接依赖 | nuget |
| System.Reflection.Primitives | 4.0.1 | 间接依赖 | nuget |
| System.Threading | 4.0.11 | 间接依赖 | nuget |
| cdt.dll | 间接依赖 | ||
| Microsoft.VisualStudio.Shell.Interop.12.0 | 12.0.30110 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Editor | 15.0.26201 | 间接依赖 | nuget |
| Microsoft.VisualStudio.SDK.VsixSuppression | 14.1.32 | 间接依赖 | nuget |
| SHELL32.dll | 间接依赖 | ||
| VSSDK.Shell.Immutable.11 | 11.0.4 | 间接依赖 | nuget |
| System.Reactive.Core | 3.1.1 | 间接依赖 | nuget |
| System.Diagnostics.Tools | 4.0.1 | 间接依赖 | nuget |
| System.Security.Cryptography.Algorithms | 4.3.0 | 间接依赖 | nuget |
| gdiplus.dll | 间接依赖 | ||
| System.Collections.Immutable | 1.1.37 | 间接依赖 | nuget |
| System.Reactive.Windows.Threading | 3.1.1 | 间接依赖 | nuget |
| freetype6.dll | 间接依赖 | ||
| libexpat | 2.0.1 | 间接依赖 | |
| VSSDK.Shell.12 | 12.0.4 | 间接依赖 | nuget |
| System.Security.Cryptography.Encoding | 4.3.0 | 间接依赖 | nuget |
| System.Linq | 4.0.0 | 间接依赖 | nuget |
| libfontconfig-1.dll | 间接依赖 | ||
| MSIMG32.DLL | 间接依赖 | ||
| System.Threading.Tasks | 4.0.11 | 间接依赖 | nuget |
| VSSDK.Shell.Interop.9 | 9.0.4 | 间接依赖 | nuget |
| System.Collections | 4.0.11 | 间接依赖 | nuget |
| Rx-Interfaces | 2.2.5 | 间接依赖 | nuget |
| VSSDK.IDE.11 | 11.0.4 | 间接依赖 | nuget |
| VSSDK.IDE.9 | 9.0.4 | 间接依赖 | nuget |
| DNSAPI.DLL | 间接依赖 | ||
| VSSDK.Language | 12.0.4 | 间接依赖 | nuget |
| System.IO.Compression | 4.3.0 | 间接依赖 | nuget |
| System.Runtime.InteropServices.WindowsRuntime | 4.0.1 | 间接依赖 | nuget |
| VSSDK.Editor | 12.0.4 | 间接依赖 | nuget |
| reactiveui | 6.5.0 | 间接依赖 | nuget |
| System.Runtime | 4.0.0 | 间接依赖 | nuget |
| ole32.dll | 间接依赖 | ||
| cgraph.dll | 间接依赖 | ||
| Microsoft.VisualStudio.Shell.Interop | 7.10.6071 | 间接依赖 | nuget |
| MSVCP90.dll | 间接依赖 | ||
| zlib | 间接依赖 | ||
| Rx-XAML | 2.2.5 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Composition | 15.0.71 | 间接依赖 | nuget |
| libgtk-win32-2.0-0.dll | 间接依赖 | ||
| VSSDK.Shell.Interop | 7.0.4 | 间接依赖 | nuget |
| Pathplan.dll | 间接依赖 | ||
| EnvDTE90 | 9.0.1 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Data.Core | 9.0.21022 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Shell.Immutable.10.0 | 10.0.30319 | 间接依赖 | nuget |
| System.Dynamic.Runtime | 4.0.11 | 间接依赖 | nuget |
| System.Runtime.InteropServices | 4.1.0 | 间接依赖 | nuget |
| System.Collections | 4.0.0 | 间接依赖 | nuget |
| System.Runtime.Extensions | 4.1.0 | 间接依赖 | nuget |
| CustomMetadataFix.Microsoft.Cci.Metadata | 3.0.0 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Language.Intellisense | 15.0.26201 | 间接依赖 | nuget |
| gvc.dll | 间接依赖 | ||
| VSSDK.Text | 12.0.4 | 间接依赖 | nuget |
| Microsoft.VisualStudio.ImageCatalog | 15.0.26201 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Text.Logic | 15.0.26201 | 间接依赖 | nuget |
| WINMM.dll | 间接依赖 | ||
| VSSDK.IDE.10 | 10.0.4 | 间接依赖 | nuget |
| libpangowin32-1.0-0.dll | 间接依赖 | ||
| libpango-1.0-0.dll | 间接依赖 | ||
| Microsoft.VisualStudio.TextManager.Interop | 7.10.6070 | 间接依赖 | nuget |
| Rx-PlatformServices | 2.2.5 | 间接依赖 | nuget |
| ADVAPI32.DLL | 间接依赖 | ||
| MSVCRT.dll | 间接依赖 | ||
| VSSDK.GraphModel | 12.0.4 | 间接依赖 | nuget |
| libpng14-14.dll | 间接依赖 | ||
| Microsoft.NETCore.Platforms | 1.0.1 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Shell.14.0 | 14.3.25407 | 间接依赖 | nuget |
| VSSDK.Shell.Immutable.12 | 12.0.4 | 间接依赖 | nuget |
| System.Reactive | 3.1.1 | 间接依赖 | nuget |
| System.Reactive.Linq | 3.1.1 | 间接依赖 | nuget |
| MSVCR80D.dll | 间接依赖 | ||
| System.Reflection | 4.1.0 | 间接依赖 | nuget |
| libpangocairo-1.0-0.dll | 间接依赖 | ||
| libxml2.dll | 间接依赖 | ||
| Microsoft.VisualStudio.Text.Data | 15.0.26201 | 间接依赖 | nuget |
| System.ValueTuple | 4.3.0 | 间接依赖 | nuget |
| reactiveui-core | 6.5.0 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Shell.Interop.10.0 | 10.0.30319 | 间接依赖 | nuget |
| System.Runtime.InteropServices.RuntimeInformation | 4.0.0 | 间接依赖 | nuget |
| libgdk-win32-2.0-0.dll | 间接依赖 | ||
| System.Reactive.PlatformServices | 3.1.1 | 间接依赖 | nuget |
| System.Xml.XDocument | 4.0.11 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Shell.Immutable.12.0 | 12.0.21003 | 间接依赖 | nuget |
| OPENGL32.dll | 间接依赖 | ||
| libpangoft2-1.0-0.dll | 间接依赖 | ||
| System.Globalization | 4.0.0 | 间接依赖 | nuget |
| VSSDK.GraphModel | 11.0.4 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Shell.Interop.11.0 | 11.0.61030 | 间接依赖 | nuget |
| reactiveui-events | 6.5.0 | 间接依赖 | nuget |
| Microsoft.VisualStudio.OLE.Interop | 7.10.6070 | 间接依赖 | nuget |
| VSSDK.IDE.8 | 8.0.4 | 间接依赖 | nuget |
| System.Diagnostics.Debug | 4.0.0 | 间接依赖 | nuget |
| VSSDK.OLE.Interop | 7.0.4 | 间接依赖 | nuget |
| Microsoft.VisualStudio.Validation | 15.0.82 | 间接依赖 | nuget |
| VSSDK.Threading | 12.0.4 | 间接依赖 | nuget |
| VSSDK.TextManager.Interop.8 | 8.0.4 | 间接依赖 | nuget |
| MSVCP80D.dll | 间接依赖 | ||
| VSSDK.Shell.Interop.8 | 8.0.4 | 间接依赖 | nuget |