Most recent entries from all

ALSA-2023:2076 — Important: libwebp security update

Affected: AlmaLinux:8: libwebp, AlmaLinux:8: libwebp-devel

The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.

Security Fix(es):

* Mozilla: libwebp: Double-free in libwebp (CVE-2023-1999)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-02923

Withdrawn: BELL-CVE-2023-1999 — CVE-2023-1999 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2023-avi-0513 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Elles permettent à u…

certfr-2023-avi-0513

EUVD-2026-216184

fkie_cve-2023-1999

There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.

GHSA-8x9p-cw2c-6253

gsd-2023-1999

OESA-2023-1317 — libwebp security update

Affected: openEuler:20.03-LTS-SP1: libwebp, openEuler:20.03-LTS-SP3: libwebp, openEuler:22.03-LTS: libwebp, openEuler:22.03-LTS-SP1: libwebp

This is an image format that does lossy compression of digital photographic images. WebP consists of a codec based on VP8, and a container based on RIFF. Webmasters, web developers and browser developers can use WebP to compress, archive and distribute digital images more efficiently. Security Fix(es): A vulnerability was found in libwebp (affected version unknown). It has been declared as critical. Affected by this vulnerability is an unknown code of the component Image File Handler. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2023-1999)

openSUSE-SU-2024:13019-1 — libsharpyuv0-1.3.0-2.1 on GA media

libsharpyuv0-1.3.0-2.1 on GA media

RHSA-2023:1785 — Red Hat Security Advisory: firefox security update

Mozilla: Memory Corruption in Safe Browsing Code Mozilla: libwebp: Double-free in libwebp Mozilla: Fullscreen notification obscured Mozilla: Potential Memory Corruption following Garbage Collector compaction Mozilla: Invalid free from JavaScript code Mozilla: Content-Disposition filename truncation leads to Reflected File Download Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux Mozilla: Incorrect optimization result on ARM64 Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10

SUSE-SU-2023:2552-1 — Security update for libwebp

Security update for libwebp

UBUNTU-CVE-2023-1999

Affected: Ubuntu:Pro:14.04:LTS: libwebp, Ubuntu:Pro:16.04:LTS: libwebp, Ubuntu:18.04:LTS: libwebp, Ubuntu:18.04:LTS: mozjs52, Ubuntu:18.04:LTS: mozjs38, Ubuntu:20.04:LTS: libwebp, Ubuntu:20.04:LTS: mozjs68, Ubuntu:20.04:LTS: mozjs52, Ubuntu:22.04:LTS: libwebp, Ubuntu:22.04:LTS: mozjs78 and 5 more

WID-SEC-W-2023-1133 — Red Hat Enterprise Linux (libwebp): Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux und Oracle Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.