GitHub Advisory DatabaseGHSA-J7HP-H8JX-5PPRlibwebp: OOB write in BuildHuffmanTable
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.68 Medium
EPSS
Percentile
97.9%
Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.
References
www.openwall.com/lists/oss-security/2023/09/21/4
www.openwall.com/lists/oss-security/2023/09/22/1
www.openwall.com/lists/oss-security/2023/09/22/3
www.openwall.com/lists/oss-security/2023/09/22/4
www.openwall.com/lists/oss-security/2023/09/22/5
www.openwall.com/lists/oss-security/2023/09/22/6
www.openwall.com/lists/oss-security/2023/09/22/7
www.openwall.com/lists/oss-security/2023/09/22/8
www.openwall.com/lists/oss-security/2023/09/26/1
www.openwall.com/lists/oss-security/2023/09/26/7
www.openwall.com/lists/oss-security/2023/09/28/1
www.openwall.com/lists/oss-security/2023/09/28/2
www.openwall.com/lists/oss-security/2023/09/28/4
adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
blog.isosceles.com/the-webp-0day/
bugzilla.suse.com/show_bug.cgi?id=1215231
chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
crbug.com/1479274
en.bandisoft.com/honeyview/history/
github.com/advisories/GHSA-j7hp-h8jx-5ppr
github.com/dlemstra/Magick.NET/releases/tag/13.3.0
github.com/electron/electron/pull/39823
github.com/electron/electron/pull/39825
github.com/electron/electron/pull/39826
github.com/electron/electron/pull/39827
github.com/electron/electron/pull/39828
github.com/ImageMagick/ImageMagick/discussions/6664
github.com/jaredforth/webp/commit/9d4c56e63abecc777df71c702503c3eaabd7dcbc
github.com/jaredforth/webp/pull/30
github.com/python-pillow/Pillow/pull/7395
github.com/qnighy/libwebp-sys2-rs/commit/4560c473a76ec8bd8c650f19ddf9d7a44f719f8b
github.com/qnighy/libwebp-sys2-rs/pull/21
github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
github.com/webmproject/libwebp/releases/tag/v1.3.2
lists.debian.org/debian-lts-announce/2023/09/msg00015.html
lists.debian.org/debian-lts-announce/2023/09/msg00016.html
lists.debian.org/debian-lts-announce/2023/09/msg00017.html
lists.fedoraproject.org/archives/list/[email protected]/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
lists.fedoraproject.org/archives/list/[email protected]/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/
lists.fedoraproject.org/archives/list/[email protected]/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
lists.fedoraproject.org/archives/list/[email protected]/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/
lists.fedoraproject.org/archives/list/[email protected]/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/
lists.fedoraproject.org/archives/list/[email protected]/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/
lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
news.ycombinator.com/item?id=37478403
nvd.nist.gov/vuln/detail/CVE-2023-4863
pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html#security
rustsec.org/advisories/RUSTSEC-2023-0060.html
rustsec.org/advisories/RUSTSEC-2023-0061.html
security-tracker.debian.org/tracker/CVE-2023-4863
security.gentoo.org/glsa/202309-05
security.gentoo.org/glsa/202401-10
security.netapp.com/advisory/ntap-20230929-0011/
sethmlarson.dev/security-developer-in-residence-weekly-report-16
stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
www.bentley.com/advisories/be-2023-0001/
www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/
www.debian.org/security/2023/dsa-5496
www.debian.org/security/2023/dsa-5497
www.debian.org/security/2023/dsa-5498
www.mozilla.org/en-US/security/advisories/mfsa2023-40/
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.68 Medium
EPSS
Percentile
97.9%