CVE-2020-28248: 
JavaScript vulnerability analysis and mitigation

An integer overflow vulnerability was discovered in png-img before version 3.1.0, affecting the PngImg::InitStorage_() function. The vulnerability (CVE-2020-28248) was identified in the package's NAN bindings for libpng, where improper handling of memory allocation could lead to a heap-based buffer overflow when processing crafted PNG files (GitHub Security Lab).

The vulnerability occurs in the PngImg::InitStorage_() function where an integer overflow during memory allocation can result in an underallocation of heap memory. The issue arises when info_.height and info_.rowbytes (both of type png_uint_32) are multiplied, potentially causing an integer wrap. For example, with info_.height set to 0x01000001 and info_.rowbytes set to 0x100, the multiplication would result in an underallocation of the data_ memory region. The vulnerability has a CVSS v3.1 base score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (NVD).

The vulnerability can lead to arbitrary code execution when png-img processes untrusted PNG files. The heap overflow provides attackers with significant control over both the contents and size of the overflow, potentially allowing for process memory corruption (GitHub Security Lab).

The vulnerability requires user interaction to exploit, specifically opening a maliciously crafted PNG file. The heap overflow can be controlled by an attacker both in terms of content and size, making it a highly exploitable vulnerability. Additionally, the attacker can control the timing of the overflow by manipulating the amount of row-data supplied in the PNG file (GitHub Security Lab).

The vulnerability was fixed in png-img version 3.1.0, released on November 3, 2020. The fix includes proper validation of image size calculations to prevent integer overflow and an upgrade of the bundled libpng from version 1.6.14 to 1.6.37 (GitHub Commit).