Spectra Assure

failRisk: Vulnerabilities

Scanned:

NetVips.Native.win-x64

latest

Top 10k

License: Copyleft (LGPL-3.0-or-later)

Published:

See on NuGet

SAFE Assessment

Compliance

Licenses

1 copyleft licensed components

Secrets

No sensitive information found

Security

Vulnerabilities

9 severe vulnerabilities exploited

Hardening

1 ineffective mitigations detected

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

List of software quality issues with the number of affected components.

Policies

Info

Problem

Software composition analysis has identified a component with one or more known severe vulnerabilities. Available threat intelligence telemetry has confirmed that the reported high or critical severity vulnerabilities are actively being exploited by malicious actors.

Prevalence in NuGet community

7 packages

found in

Top 100

164 packages

found in

Top 1k

1745 packages

found in

Top 10k

64.35k packages

in community

Next steps

We strongly advise updating the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as critical severity.

Prevalence in NuGet community

0 packages

found in

Top 100

65 packages

found in

Top 1k

757 packages

found in

Top 10k

19.24k packages

in community

Next steps

Perform impact analysis for the reported CVEs.

We strongly advise updating the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.

Prevalence in NuGet community

17 packages

found in

Top 100

346 packages

found in

Top 1k

2889 packages

found in

Top 10k

95.73k packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Weak copyleft licenses in particular impose requirements that the user must be able to replace or update the code they apply to. In practical terms, that means the object and library files that statically link to weak copyleft code must be made available publicly. For commercial applications, this is typically undesirable. Therefore, statically linking to weak copyleft code is commonly avoided or even prohibited by the organization policy. Instead of linking statically to weak copyleft licensed code, it is recommended to isolate such code into modules that the publisher-developed, first-party code can dynamically link to without the aforementioned obligations.

Prevalence in NuGet community

0 packages

found in

Top 100

3 packages

found in

Top 1k

69 packages

found in

Top 10k

1.42k packages

in community

Next steps

Confirm that the software package statically links to a weak copyleft dependency.

Investigate if the software publisher provides this dependency under a non-copyleft license.

Consider replacing the software dependency with an alternative that offers a license compatible with commercial use.

Alternatively, repackage the code so that it dynamically links to a weak copyleft dependency.

Problem

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Some software licenses place restrictions on software distribution of the code they apply to. These restrictions may extend to the services built upon the code licensed under such restrictive licenses. Some restrictive licenses explicitly state that the licensee may not provide the software to third parties as a hosted or managed service, where the service provides users with access to any substantial set of the features or functionality of the licensed software. When building commercial applications, this is typically undesirable. Therefore, the inclusion of any code that may impose limits on software distribution is commonly avoided or even prohibited by the organization policy.

Prevalence in NuGet community

0 packages

found in

Top 100

12 packages

found in

Top 1k

222 packages

found in

Top 10k

15.19k packages

in community

Next steps

Confirm that the software package references a component or a dependency with a restrictive license.

Consider replacing the software component with an alternative that offers a license compatible with organization policy.

Problem

Buffer overrun protection (Stack Guard) is a vulnerability mitigation option that prevents stack-based memory corruptions. Special values, called stack cookies, are inserted in the stack immediately before the return address value. Code flow protection is achieved by monitoring for unexpected stack cookie value changes. The application does try to implement buffer overrun protection, but the stack cookie it depends on is absent from the headers.

Prevalence in NuGet community

0 packages

found in

Top 100

0 packages

found in

Top 1k

7 packages

found in

Top 10k

75 packages

in community

Next steps

Review the programming language linker options, or consider using a different executable packing solution.

In Microsoft VisualStudio, you can enable buffer overrun protection mitigation by setting the linker option /GS to ON.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as medium severity.

Prevalence in NuGet community

8 packages

found in

Top 100

161 packages

found in

Top 1k

1378 packages

found in

Top 10k

37.45k packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Copyleft licenses in particular impose substantial restrictions on the licensee. They typically require that any derived works, and even software code that merely interacts with copyleft code, be licensed under the same license. Since copyleft licenses are commonly applied to open source code, their inclusion requires that the entire software package becomes open sourced. For commercial applications, this is typically undesirable. Therefore, the inclusion of copyleft code is commonly avoided or even prohibited by the organization policy.

Prevalence in NuGet community

0 packages

found in

Top 100

2 packages

found in

Top 1k

64 packages

found in

Top 10k

3.84k packages

in community

Next steps

Confirm that the software component references a copyleft dependency.

Investigate if the software publisher provides this dependency under a non-copyleft license.

Consider replacing the software dependency with an alternative that offers a license compatible with commercial use.

Problem

Control Flow Guard (CFG/CFI) protects the code flow integrity by ensuring that indirect calls are made only to vetted functions. This mitigation protects dynamically resolved function targets by instrumenting the code responsible for transferring execution control. Because the code flow integrity is verified during runtime, malicious code is less likely to be able to hijack trusted execution paths.

Prevalence in NuGet community

0 packages

found in

Top 100

29 packages

found in

Top 1k

343 packages

found in

Top 10k

9.57k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.

To enable this mitigation, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Control Flow Guard (CFG/CFI) protects the code flow integrity by ensuring that dynamic calls are made only to vetted functions. Trusted execution paths rely on the ability of the operating system to build a list of valid function targets. Certain functions can intentionally be disallowed to prevent malicious code from deactivating vulnerability mitigation features. A list of such invalid function targets can include publicly exported symbols. Applications that enhance control flow integrity through export suppression rely on libraries to mark their publicly visible symbols as suppressed. This is done for all symbols that are considered to be sensitive functions, and to which access should be restricted. It is considered dangerous to mix applications that perform export suppression with libraries that do not.

Prevalence in NuGet community

0 packages

found in

Top 100

48 packages

found in

Top 1k

527 packages

found in

Top 10k

16.29k packages

in community

Next steps

To enable this mitigation on library code, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Prevalence in NuGet community

7 packages

found in

Top 100

164 packages

found in

Top 1k

1745 packages

found in

Top 10k

64.35k packages

in community

Next steps

We strongly advise updating the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as critical severity.

Prevalence in NuGet community

0 packages

found in

Top 100

65 packages

found in

Top 1k

757 packages

found in

Top 10k

19.24k packages

in community

Next steps

Perform impact analysis for the reported CVEs.

We strongly advise updating the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.

Prevalence in NuGet community

17 packages

found in

Top 100

346 packages

found in

Top 1k

2889 packages

found in

Top 10k

95.73k packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Prevalence in NuGet community

0 packages

found in

Top 100

3 packages

found in

Top 1k

69 packages

found in

Top 10k

1.42k packages

in community

Next steps

Confirm that the software package statically links to a weak copyleft dependency.

Investigate if the software publisher provides this dependency under a non-copyleft license.

Consider replacing the software dependency with an alternative that offers a license compatible with commercial use.

Alternatively, repackage the code so that it dynamically links to a weak copyleft dependency.

Problem

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Some software licenses place restrictions on software distribution of the code they apply to. These restrictions may extend to the services built upon the code licensed under such restrictive licenses. Some restrictive licenses explicitly state that the licensee may not provide the software to third parties as a hosted or managed service, where the service provides users with access to any substantial set of the features or functionality of the licensed software. When building commercial applications, this is typically undesirable. Therefore, the inclusion of any code that may impose limits on software distribution is commonly avoided or even prohibited by the organization policy.

Prevalence in NuGet community

0 packages

found in

Top 100

12 packages

found in

Top 1k

222 packages

found in

Top 10k

15.19k packages

in community

Next steps

Confirm that the software package references a component or a dependency with a restrictive license.

Consider replacing the software component with an alternative that offers a license compatible with organization policy.

Problem

Prevalence in NuGet community

0 packages

found in

Top 100

0 packages

found in

Top 1k

7 packages

found in

Top 10k

75 packages

in community

Next steps

Review the programming language linker options, or consider using a different executable packing solution.

In Microsoft VisualStudio, you can enable buffer overrun protection mitigation by setting the linker option /GS to ON.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as medium severity.

Prevalence in NuGet community

8 packages

found in

Top 100

161 packages

found in

Top 1k

1378 packages

found in

Top 10k

37.45k packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Copyleft licenses in particular impose substantial restrictions on the licensee. They typically require that any derived works, and even software code that merely interacts with copyleft code, be licensed under the same license. Since copyleft licenses are commonly applied to open source code, their inclusion requires that the entire software package becomes open sourced. For commercial applications, this is typically undesirable. Therefore, the inclusion of copyleft code is commonly avoided or even prohibited by the organization policy.

Prevalence in NuGet community

0 packages

found in

Top 100

2 packages

found in

Top 1k

64 packages

found in

Top 10k

3.84k packages

in community

Next steps

Confirm that the software component references a copyleft dependency.

Investigate if the software publisher provides this dependency under a non-copyleft license.

Consider replacing the software dependency with an alternative that offers a license compatible with commercial use.

Problem

Prevalence in NuGet community

0 packages

found in

Top 100

29 packages

found in

Top 1k

343 packages

found in

Top 10k

9.57k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.

To enable this mitigation, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Prevalence in NuGet community

0 packages

found in

Top 100

48 packages

found in

Top 1k

527 packages

found in

Top 10k

16.29k packages

in community

Next steps

To enable this mitigation on library code, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

NetVips.Native.win-x64

SAFE Assessment

Compliance

Security

Threats

SQ31102Detected presence of severe vulnerabilities with active exploitation.Causes risk: actively exploited vulnerabilitiesvulnerabilities

Problem

Prevalence in NuGet community

Next steps

SQ31104Detected presence of critical severity vulnerabilities.Causes risk: critical severity vulnerabilitiesvulnerabilities

Problem

Prevalence in NuGet community

Next steps

SQ31105Detected presence of high severity vulnerabilities.Causes risk: high severity vulnerabilitiesvulnerabilities

Problem

Prevalence in NuGet community

Next steps

SQ12103Detected presence of statically linked dependencies distributed with weak copyleft licenses.Causes risk: weak copyleft linked componentslicenses

Problem

Prevalence in NuGet community

Next steps

SQ12405Detected presence of licenses that place restrictions on software distribution.Causes risk: software distribution restrictionslicenses

Problem

Prevalence in NuGet community

Next steps

SQ14115Detected Windows executable files that try to implement buffer overrun vulnerability mitigation without the appropriate security cookie.Causes risk: ineffective mitigations detectedhardening

Problem

Prevalence in NuGet community

Next steps

SQ31106Detected presence of medium severity vulnerabilities.Causes risk: medium severity vulnerabilitiesvulnerabilities

Problem

Prevalence in NuGet community

Next steps

SQ12102Detected presence of software dependencies distributed with copyleft licenses.Causes risk: copyleft licensed componentslicenses

Problem

Prevalence in NuGet community

Next steps

SQ14122Detected Windows executable files that do not implement CFG vulnerability mitigation protection.Causes risk: modern mitigations missinghardening

Problem

Prevalence in NuGet community

Next steps

SQ14125Detected Windows shared library files that do not suppress exports which reduces CFG vulnerability mitigation protection effectiveness.Causes risk: low priority mitigations absenthardening

Problem

Prevalence in NuGet community

Next steps

Did you know...

SQ31102Detected presence of severe vulnerabilities with active exploitation.Causes risk: actively exploited vulnerabilitiesvulnerabilities

Problem

Prevalence in NuGet community

Next steps

SQ31104Detected presence of critical severity vulnerabilities.Causes risk: critical severity vulnerabilitiesvulnerabilities

Problem

Prevalence in NuGet community

Next steps

SQ31105Detected presence of high severity vulnerabilities.Causes risk: high severity vulnerabilitiesvulnerabilities

Problem

Prevalence in NuGet community

Next steps

SQ12103Detected presence of statically linked dependencies distributed with weak copyleft licenses.Causes risk: weak copyleft linked componentslicenses

Problem

Prevalence in NuGet community

Next steps

SQ12405Detected presence of licenses that place restrictions on software distribution.Causes risk: software distribution restrictionslicenses

Problem

Prevalence in NuGet community

Next steps

SQ14115Detected Windows executable files that try to implement buffer overrun vulnerability mitigation without the appropriate security cookie.Causes risk: ineffective mitigations detectedhardening

Problem

Prevalence in NuGet community

Next steps

SQ31106Detected presence of medium severity vulnerabilities.Causes risk: medium severity vulnerabilitiesvulnerabilities

Problem

Prevalence in NuGet community

Next steps

SQ12102Detected presence of software dependencies distributed with copyleft licenses.Causes risk: copyleft licensed componentslicenses

Problem

Prevalence in NuGet community

Next steps

SQ14122Detected Windows executable files that do not implement CFG vulnerability mitigation protection.Causes risk: modern mitigations missinghardening

Problem