Most recent entries from all

ALSA-2021:4231 — Moderate: libwebp security update

2026-10-02T19:20:33.584819+00:00

Affected: AlmaLinux:8: libwebp, AlmaLinux:8: libwebp-devel

The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.

Security Fix(es):

* libwebp: out-of-bounds read in WebPMuxCreateInternal (CVE-2018-25009)

* libwebp: out-of-bounds read in ApplyFilter() (CVE-2018-25010)

* libwebp: out-of-bounds read in WebPMuxCreateInternal() (CVE-2018-25012)

* libwebp: out-of-bounds read in ShiftBytes() (CVE-2018-25013)

* libwebp: use of uninitialized value in ReadSymbol() (CVE-2018-25014)

* libwebp: out-of-bounds read in ChunkVerifyAndAssign() in mux/muxread.c (CVE-2020-36330)

* libwebp: out-of-bounds read in ChunkAssignData() in mux/muxinternal.c (CVE-2020-36331)

* libwebp: excessive memory allocation when reading a file (CVE-2020-36332)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2021-03106

2026-10-02T19:20:33.584896+00:00

bdu:2021-03106

certfr-2021-avi-562 — De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaqu…

2026-10-02T19:20:33.584914+00:00

certfr-2021-avi-562

cnvd-2021-37660

2026-10-02T19:20:33.584953+00:00

cnvd-2021-37660

EUVD-2026-70921

2026-10-02T19:20:33.584977+00:00

EUVD-2026-70921

fkie_cve-2018-25014

2026-10-02T19:20:33.584995+00:00

A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().

GHSA-rr28-4v9r-6wcq

2026-10-02T19:20:33.585028+00:00

A flaw was found in libwebp in versions before 1.0.1. An unitialized variable is used in function ReadSymbol. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

gsd-2018-25014

2026-10-02T19:20:33.585053+00:00

gsd-2018-25014

msrc_CVE-2018-25014 — A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().

2026-10-02T19:20:33.585071+00:00

msrc_CVE-2018-25014

RHSA-2021:2328 — Red Hat Security Advisory: qt5-qtimageformats security update

2026-10-02T19:20:33.585101+00:00

libwebp: heap-based buffer overflow in PutLE16() libwebp: use of uninitialized value in ReadSymbol() libwebp: heap-based buffer overflow in WebPDecode*Into functions libwebp: use-after-free in EmitFancyRGB() in dec/io_dec.c

UBUNTU-CVE-2018-25014

2026-10-02T19:20:33.585152+00:00

Affected: Ubuntu:Pro:14.04:LTS: libwebp, Ubuntu:Pro:16.04:LTS: libwebp, Ubuntu:18.04:LTS: libwebp, Ubuntu:20.04:LTS: libwebp

A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().

WID-SEC-W-2023-1123 — Red Hat Enterprise Linux (libwebp): Mehrere Schwachstellen

2026-10-02T19:20:33.585195+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux libwebp ausnutzen, um Informationen offenzulegen, einen Denial of Service zu verursachen oder Sicherheitsvorkehrungen zu umgehen.