Important: libwebp security update
Summary
ALSA-2023:2078: Important: libwebp security update. Affects libwebp versions < 1.2.0-6.el9_1. Fixed in 1.2.0-6.el9_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers, and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.
Vulnerability Detail
The libwebp package is affected by a double-free vulnerability in libwebp, identified as CVE-2023-1999. This vulnerability could allow an attacker to cause a denial of service or potentially execute arbitrary code by exploiting the double-free issue. The impact of this vulnerability can vary depending on the context in which the libwebp library is used.
How To Fix
Minimum fixed version
1.2.0-6.el9_1
This is the first release that contains the fix.
sudo dnf update libwebpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is crucial to update the libwebp package to the fixed version to mitigate the risk of exploitation. Failure to do so may result in a denial of service or potential execution of arbitrary code. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libwebp →
FAQ
Libwebp is a library and set of tools for the WebP graphics format, which is used for efficient image compression and distribution.
The vulnerability in libwebp could allow an attacker to cause a denial of service or potentially execute arbitrary code.
To fix this vulnerability, update the libwebp package to version 1.2.0-6.el9_1 or later.
No specific workarounds have been provided for this vulnerability. It is recommended to update the package to the fixed version.
More information about this vulnerability can be found in the CVE page: CVE-2023-1999.
Related vulnerabilities
Recent vulnerabilities recorded for libwebp.
