Most recent entries from all

ALSA-2021:4231 — Moderate: libwebp security update

Affected: AlmaLinux:8: libwebp, AlmaLinux:8: libwebp-devel

The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.

Security Fix(es):

* libwebp: out-of-bounds read in WebPMuxCreateInternal (CVE-2018-25009)

* libwebp: out-of-bounds read in ApplyFilter() (CVE-2018-25010)

* libwebp: out-of-bounds read in WebPMuxCreateInternal() (CVE-2018-25012)

* libwebp: out-of-bounds read in ShiftBytes() (CVE-2018-25013)

* libwebp: use of uninitialized value in ReadSymbol() (CVE-2018-25014)

* libwebp: out-of-bounds read in ChunkVerifyAndAssign() in mux/muxread.c (CVE-2020-36330)

* libwebp: out-of-bounds read in ChunkAssignData() in mux/muxinternal.c (CVE-2020-36331)

* libwebp: excessive memory allocation when reading a file (CVE-2020-36332)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2021-03106

certfr-2021-avi-562 — De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaqu…

certfr-2021-avi-562

cnvd-2021-37660

EUVD-2026-70921

fkie_cve-2018-25014

A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().

GHSA-rr28-4v9r-6wcq

A flaw was found in libwebp in versions before 1.0.1. An unitialized variable is used in function ReadSymbol. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

gsd-2018-25014

msrc_CVE-2018-25014 — A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().

msrc_CVE-2018-25014

RHSA-2021:2328 — Red Hat Security Advisory: qt5-qtimageformats security update

libwebp: heap-based buffer overflow in PutLE16() libwebp: use of uninitialized value in ReadSymbol() libwebp: heap-based buffer overflow in WebPDecode*Into functions libwebp: use-after-free in EmitFancyRGB() in dec/io_dec.c

UBUNTU-CVE-2018-25014

Affected: Ubuntu:Pro:14.04:LTS: libwebp, Ubuntu:Pro:16.04:LTS: libwebp, Ubuntu:18.04:LTS: libwebp, Ubuntu:20.04:LTS: libwebp

A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().

WID-SEC-W-2023-1123 — Red Hat Enterprise Linux (libwebp): Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux libwebp ausnutzen, um Informationen offenzulegen, einen Denial of Service zu verursachen oder Sicherheitsvorkehrungen zu umgehen.