Affected: AlmaLinux:8: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 102.15.1 ESR.

Security Fix(es):

* libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Homebrew: pillow

Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.

Affected: CleanStart: chromium

Security vulnerability affects the chromium package. Heap buffer overflow in libwebp in Google Chrome prior to 116.

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Affected: crates.io: libwebp-sys2, crates.io: libwebp-sys, npm: electron, NuGet: SkiaSharp, Go: github.com/chai2010/webp, PyPI: Pillow, crates.io: webp, NuGet: magick.net-q16-anycpu, NuGet: magick.net-q16-hdri-anycpu, NuGet: magick.net-q16-x64 and 3 more

Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.

The affected products are vulnerable to an out of bounds write vulnerability in the integrated libwebp library, that could be triggered while parsing specially crafted image files. This could allow an attacker to execute code in the context of a victim user's system. As a precondition, the user needs to add such image files, or Mendix Marketplace content that contains such image files, to their project. The exploitation happens in certain scenarios when the user opens the document that contains the image.

Affected: openEuler:20.03-LTS-SP1: libwebp, openEuler:20.03-LTS-SP3: libwebp, openEuler:22.03-LTS: libwebp, openEuler:22.03-LTS-SP1: libwebp, openEuler:22.03-LTS-SP2: libwebp

This is an image format that does lossy compression of digital photographic images. WebP consists of a codec based on VP8, and a container based on RIFF. Webmasters, web developers and browser developers can use WebP to compress, archive and distribute digital images more efficiently. Security Fix(es): Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)(CVE-2023-4863)

Security update for chromium

Affected: PyPI: pillow

Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.

libwebp: Heap buffer overflow in WebP Codec

Affected: crates.io: libwebp-sys2

[Google](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html) and [Mozilla](https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/) have released security advisories for RCE due to heap overflow in libwebp. Google warns the vulnerability has been exploited in the wild.

libwebp needs to be updated to 1.3.2 to include a patch for "OOB write in BuildHuffmanTable".

Security update for MozillaFirefox

Affected: Ubuntu:Pro:18.04:LTS: libwebp, Ubuntu:20.04:LTS: firefox, Ubuntu:20.04:LTS: libwebp, Ubuntu:20.04:LTS: thunderbird, Ubuntu:22.04:LTS: libwebp, Ubuntu:22.04:LTS: thunderbird

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Several Pilz products use the 3rd-party component 'libwebp' for decoding of images in WebP format. This component is affected by a vulnerability, which may enable an attacker to gain full control over the system running the software product. Depending on the affected product, the vulnerabilities can be exploited locally or over the network.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Google Chrome / Microsoft Edge ausnutzen, um beliebigen Programmcode auszuführen.