[QUESTION] Security Vulnerabilities detected by Binary Analysis Scan (Black Duck Binary Analysis)

[timu]

Hi,

We have a Xamarin Forms v5.0.0.2337 project. We ran a binary analysis scan on the project by using the Black Duck Binary Analysis tool and it reports back security vulnerabilities from the libraries that SkiaSharp uses. We wanted to report these to you and also ask for a roadmap to update these libraries.

Below you can find the specific versions detected by the binary analysis scan and also the vulnerabilities that are detected for each library with their NATIONAL VULNERABILITY DATABASE URL.

Name	Version
expat	2.2.9
freetype	2.10.1
libjpeg-turbo	2.0.0
libwebp	v0.6.1-rc2

Vulnerability URLs

1. expat:

• http://nvd.nist.gov/vuln/detail/CVE-2013-0340
• http://nvd.nist.gov/vuln/detail/CVE-2021-45960
• http://nvd.nist.gov/vuln/detail/CVE-2021-46143
• http://nvd.nist.gov/vuln/detail/CVE-2022-22822
• http://nvd.nist.gov/vuln/detail/CVE-2022-22823
• http://nvd.nist.gov/vuln/detail/CVE-2022-22824
• http://nvd.nist.gov/vuln/detail/CVE-2022-22825
• http://nvd.nist.gov/vuln/detail/CVE-2022-22826
• http://nvd.nist.gov/vuln/detail/CVE-2022-22827
• http://nvd.nist.gov/vuln/detail/CVE-2022-23852
• http://nvd.nist.gov/vuln/detail/CVE-2022-23990
• http://nvd.nist.gov/vuln/detail/CVE-2022-25235
• http://nvd.nist.gov/vuln/detail/CVE-2022-25236
• http://nvd.nist.gov/vuln/detail/CVE-2022-25313
• http://nvd.nist.gov/vuln/detail/CVE-2022-25314
• http://nvd.nist.gov/vuln/detail/CVE-2022-25315

2. freetype

• http://nvd.nist.gov/vuln/detail/CVE-2020-15999

3. libjpeg-turbo

• http://nvd.nist.gov/vuln/detail/CVE-2020-17541

4. libwebp

• http://nvd.nist.gov/vuln/detail/CVE-2018-25009
• http://nvd.nist.gov/vuln/detail/CVE-2018-25010
• http://nvd.nist.gov/vuln/detail/CVE-2018-25011
• http://nvd.nist.gov/vuln/detail/CVE-2018-25012
• http://nvd.nist.gov/vuln/detail/CVE-2018-25013
• http://nvd.nist.gov/vuln/detail/CVE-2018-25014
• http://nvd.nist.gov/vuln/detail/CVE-2020-36328
• http://nvd.nist.gov/vuln/detail/CVE-2020-36329
• http://nvd.nist.gov/vuln/detail/CVE-2020-36330
• http://nvd.nist.gov/vuln/detail/CVE-2020-36331
• http://nvd.nist.gov/vuln/detail/CVE-2020-36332

Kind regards.

[mattleibow]

Freetype should no longer have the vulnerability because it was bumped a long time ago in this commit: mono/skia@5416016

The SkiaSharp package was first published a while back in v2.88.0-preview.61

[mattleibow]

libjpeg-turbo is also past this fix and is on 2.0.5. Also, the fix is first in v2.88.0-preview.61

[mattleibow]

libwebp is also far beyond the version that has the issues. It was on 1.1.0 but I am just updating to 1.2.3 just in case.

[mattleibow]

I have updated all the listed externals that needed updated and so I am closing this. As soon as the build is complete, it will be on the preview feed as version: 2.88.1-preview.96

After some testing by folks, I will push this out to nuget and start work on finalizing a stable release.