Important: libwebp security update
Summary
RLSA-2023:2078: Important: libwebp security update. Affects libwebp across 2 version ranges.
< 0:1.2.0-6.el9_1
< 0:1.2.0-6.el9_1.0.1
Fixed in 0:1.2.0-6.el9_1 or 0:1.2.0-6.el9_1.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers, and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.
Vulnerability Detail
The libwebp package is affected by a double-free vulnerability in libwebp, identified as CVE-2023-1999. This vulnerability could allow an attacker to cause a denial of service or potentially execute arbitrary code by exploiting the double-free issue. The impact of this vulnerability can vary depending on the context in which the libwebp library is used. It is important to apply the security update to mitigate the risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update libwebp-
< 0:1.2.0-6.el9_10:1.2.0-6.el9_1 -
< 0:1.2.0-6.el9_1.0.10:1.2.0-6.el9_1.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The libwebp package is affected by a double-free vulnerability that could allow an attacker to cause a denial of service or execute arbitrary code. It is crucial to update the libwebp package to the latest version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libwebp →
FAQ
Libwebp is a library and set of tools for the WebP graphics format, which is used for efficient compression and distribution of digital images.
The vulnerability could allow an attacker to cause a denial of service or potentially execute arbitrary code by exploiting the double-free issue in libwebp.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and the tool will provide real-time alerts for open-source vulnerabilities.
No specific workarounds have been provided for this vulnerability. It is recommended to apply the security update as soon as possible.
You can refer to the CVE page for CVE-2023-1999 for more details about the vulnerability, including its impact, CVSS score, acknowledgments, and related information.
Related vulnerabilities
Recent vulnerabilities recorded for libwebp.
