ALSA-2023:5309 - libwebp Heap Buffer Overflow
Summary
ALSA-2023:5309: Important: libwebp security update. Affects libwebp versions < 1.0.0-8.el8_8.1. Fixed in 1.0.0-8.el8_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libwebp is a library and set of tools for the WebP graphics format, which is a lossy compression format for digital images. It includes a codec based on the VP8 format and a container based on the RIFF format. libwebp is used by webmasters, web developers, and browser developers to compress, archive, and distribute digital images more efficiently.
Vulnerability Detail
The libwebp package is affected by a heap buffer overflow vulnerability in the WebP Codec. This vulnerability, identified as CVE-2023-4863, can be exploited by an attacker to execute arbitrary code or cause a denial of service. The vulnerability occurs due to improper handling of certain image data, leading to a buffer overflow in the heap memory. An attacker can craft a malicious image file that, when processed by an application using libwebp, triggers the overflow and allows the attacker to execute arbitrary code or crash the application.
How To Fix
Minimum fixed version
1.0.0-8.el8_8.1
This is the first release that contains the fix.
sudo dnf update libwebpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The libwebp package is affected by a heap buffer overflow vulnerability that can be exploited to execute arbitrary code or cause a denial of service. It is recommended to update the libwebp package to version 1.0.0-8.el8_8.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for libwebp →
FAQ
libwebp is a library and set of tools for the WebP graphics format, which is a lossy compression format for digital images.
This vulnerability allows an attacker to execute arbitrary code or cause a denial of service by exploiting a heap buffer overflow in the WebP Codec.
To fix this vulnerability, update the libwebp package to version 1.0.0-8.el8_8.1 or later.
Updating the package is the recommended solution. However, if updating is not possible, you can consider implementing additional security measures such as restricting access to applications using libwebp or applying network-level controls.
At the time of this advisory, there are no known public exploits for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for libwebp.
