CVE-2023-4863: Security vulnerability in WebP
Summary
CVE-2023-4863: In BuildHuffmanTable of huffman_utils.c, there is a possible out of bounds write due to a heap buffer overflow. Affects platform/external/webp across 5 version ranges.
>= 11:0, < 11:2023-10-06
>= 12:0, < 12:2023-10-06
>= 12L:0, < 12L:2023-10-06
>= 13:0, < 13:2023-10-06
>= 14-next:0, < 14-next:2023-10-06
Fixed in 14-next:2023-10-06. How to fix ↓
Also tracked for
- pillow · PyPI
- libwebp-sys2 · crates.io
- libwebp · Alpine:v3.15
- libwebp-sys · crates.io
- libwebp-sys2 · crates.io
The same CVE-2023-4863 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WebP is an image format developed by Google that provides lossless and lossy compression for images on the web. It is widely used in Android applications for efficient image storage and display. However, a security vulnerability has been discovered in the WebP library that could allow remote code execution without requiring any additional execution privileges or user interaction.
Vulnerability Detail
The vulnerability resides in the BuildHuffmanTable function of the huffman_utils.c file. It is caused by a heap buffer overflow, which can result in an out of bounds write. An attacker could exploit this vulnerability to execute arbitrary code on a target system. The impact of this vulnerability is critical as it could lead to a complete compromise of the affected system.
How To Fix
Minimum fixed version
14-next:2023-10-06
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the official fix provided by the Android platform as soon as possible.
Conclusion
In conclusion, a critical security vulnerability has been discovered in the WebP library used in Android applications. This vulnerability could allow remote code execution without requiring any additional execution privileges or user interaction. It is crucial to update the WebP library to a fixed version as soon as possible to mitigate the risk of exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/external/webp →
FAQ
WebP is an image format developed by Google that provides lossless and lossy compression for images on the web. It offers smaller file sizes and faster loading times compared to other image formats.
This vulnerability affects Android applications that use the WebP library for image processing. If exploited, it could allow an attacker to execute arbitrary code on a target system, potentially leading to a complete compromise of the affected application.
No, user interaction is not needed for the exploitation of this vulnerability. An attacker can remotely trigger the vulnerability without any user involvement.
No, only versions 11, 12, 12L, and 13 of the Android platform's external WebP package are affected. The vulnerability has been fixed in subsequent versions.
The severity of this vulnerability is classified as critical. It could lead to remote code execution, allowing an attacker to take full control of the affected system.
