Most recent entries from all

ALSA-2023:5184 — Important: firefox security update

Affected: AlmaLinux:8: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 102.15.1 ESR.

Security Fix(es):

* libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-05510

BREW-pillow-CVE-2023-4863 — libwebp: OOB write in BuildHuffmanTable

Affected: Homebrew: pillow

Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.

certfr-2023-avi-0730 — Une vulnérabilité a été découverte dans Google Chrome. Elle permet à un attaquant de provoq…

certfr-2023-avi-0730

CLEANSTART-2024-ZN11059 — Heap buffer overflow in libwebp in Google Chrome prior to 116

Affected: CleanStart: chromium

Security vulnerability affects the chromium package. Heap buffer overflow in libwebp in Google Chrome prior to 116.

cnvd-2023-71680

EUVD-2026-255708

fkie_cve-2023-4863

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

GHSA-j7hp-h8jx-5ppr — libwebp: OOB write in BuildHuffmanTable

Affected: crates.io: libwebp-sys2, crates.io: libwebp-sys, npm: electron, NuGet: SkiaSharp, Go: github.com/chai2010/webp, PyPI: Pillow, crates.io: webp, NuGet: magick.net-q16-anycpu, NuGet: magick.net-q16-hdri-anycpu, NuGet: magick.net-q16-x64 and 3 more

Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.

gsd-2023-4863

ICSA-23-320-11 — Siemens Mendix Studio Pro

The affected products are vulnerable to an out of bounds write vulnerability in the integrated libwebp library, that could be triggered while parsing specially crafted image files. This could allow an attacker to execute code in the context of a victim user's system. As a precondition, the user needs to add such image files, or Mendix Marketplace content that contains such image files, to their project. The exploitation happens in certain scenarios when the user opens the document that contains the image.

OESA-2023-1681 — libwebp security update

Affected: openEuler:20.03-LTS-SP1: libwebp, openEuler:20.03-LTS-SP3: libwebp, openEuler:22.03-LTS: libwebp, openEuler:22.03-LTS-SP1: libwebp, openEuler:22.03-LTS-SP2: libwebp

This is an image format that does lossy compression of digital photographic images. WebP consists of a codec based on VP8, and a container based on RIFF. Webmasters, web developers and browser developers can use WebP to compress, archive and distribute digital images more efficiently. Security Fix(es): Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)(CVE-2023-4863)

openSUSE-SU-2023:0246-1 — Security update for chromium

Security update for chromium

PYSEC-2026-1794 — libwebp: OOB write in BuildHuffmanTable

Affected: PyPI: pillow

Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.

RHBA-2023:5988 — Red Hat Bug Fix Advisory: Updated rhel9/firefox-flatpak container image

libwebp: Heap buffer overflow in WebP Codec

RUSTSEC-2023-0060 — libwebp: OOB write in BuildHuffmanTable

Affected: crates.io: libwebp-sys2

[Google](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html) and [Mozilla](https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/) have released security advisories for RCE due to heap overflow in libwebp. Google warns the vulnerability has been exploited in the wild.

libwebp needs to be updated to 1.3.2 to include a patch for "OOB write in BuildHuffmanTable".

SUSE-SU-2023:3609-1 — Security update for MozillaFirefox

Security update for MozillaFirefox

UBUNTU-CVE-2023-4863

Affected: Ubuntu:Pro:18.04:LTS: libwebp, Ubuntu:20.04:LTS: firefox, Ubuntu:20.04:LTS: libwebp, Ubuntu:20.04:LTS: thunderbird, Ubuntu:22.04:LTS: libwebp, Ubuntu:22.04:LTS: thunderbird

VDE-2023-048 — Pilz: Multiple products prone to libwebp vulnerability

Several Pilz products use the 3rd-party component 'libwebp' for decoding of images in WebP format. This component is affected by a vulnerability, which may enable an attacker to gain full control over the system running the software product. Depending on the affected product, the vulnerabilities can be exploited locally or over the network.

WID-SEC-W-2023-2305 — Google Chrome / Microsoft Edge: Schwachstelle ermöglicht Codeausführung

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Google Chrome / Microsoft Edge ausnutzen, um beliebigen Programmcode auszuführen.