Heap buffer overflow in libwebp Codec
Summary
ALSA-2023:5214: Important: libwebp security update. Affects libwebp versions < 1.2.0-7.el9_2. Fixed in 1.2.0-7.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libwebp is a library and set of tools for the WebP graphics format, which is used for compressing, archiving, and distributing digital images more efficiently. It is based on the VP8 format codec and the Resource Interchange File Format (RIFF) container. The library is widely used by webmasters, web developers, and browser developers.
Vulnerability Detail
A heap buffer overflow vulnerability (CVE-2023-4863) has been discovered in the libwebp Codec. This vulnerability could allow an attacker to overwrite adjacent memory locations, potentially leading to remote code execution or a denial of service attack. The vulnerability is considered important and should be addressed promptly.
How To Fix
Minimum fixed version
1.2.0-7.el9_2
This is the first release that contains the fix.
sudo dnf update libwebpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to mitigate the risk.
Conclusion
The heap buffer overflow vulnerability in libwebp Codec poses a significant risk and should be addressed immediately. Users are advised to update the libwebp package to version 1.2.0-7.el9_2 or later to mitigate the vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libwebp →
FAQ
libwebp is a library and set of tools for the WebP graphics format, which provides efficient compression and distribution of digital images.
The heap buffer overflow vulnerability in libwebp Codec could allow an attacker to execute arbitrary code or cause a denial of service.
To fix this vulnerability, update the libwebp package to version 1.2.0-7.el9_2 or later.
There is no known workaround for this vulnerability. It is crucial to apply the security update.
More information about this vulnerability can be found in the CVE-2023-4863 advisory.
Related vulnerabilities
Recent vulnerabilities recorded for libwebp.
