Fedora: Security Advisory for libwebp (FEDORA-2023-e692a72898)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Buffer Overflow

libexempi.so is vulnerable to Buffer Overflow. The vulnerability exists in the VP8XChunk function of WEBPSupport.cpp, allowing an attacker to crash the application by opening a maliciously crafted webp file...

WordPress cits-support-svg-webp-media-upload Plugin < 3.0 is vulnerable to Cross Site Scripting (XSS)

Software cits-support-svg-webp-media-upload Type Plugin Vulnerable versions 3.0 Fixed in 3.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5458 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c76219dcef8a Credits Bob Matyas...

CITS Support svg, webp Media and TTF,OTF File Upload < 3.0 - Author+ Stored XSS via SVG

Description The plugin does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. PoC As an author, upload an SVG with the payload: View the SVG and see the XSS...

libwebp security update

An update is available for libwebp. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libwebp packages provide a library and tools for the WebP graphics format...

Updated libwebp packages fix a security vulnerability

Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page...

Updated chromium-browser-stable package fixes bugs and vulnerabilities

The chromium-browser-stable package has been updated to the 117.0.5938.92 release, fixing bugs and 31 vulnerabilities, together with 117.0.5938.92, 117.0.5938.88, 117.0.5938.62, 116.0.5845.187 and 116.0.5845.179. Google is aware that an exploit for CVE-2023-5217 exists in the wild. High...

[SECURITY] Fedora 39 Update: libwebp-1.3.2-2.fc39

WebP is an image format that does lossy compression of digital photographic images. WebP consists of a codec based on VP8, and a container based on RIFF. Webmasters, web developers and browser developers can use WebP to compress, archive and distribute digital images more efficiently...

Microsoft’s Response to Open-Source Vulnerabilities - CVE-2023-4863 and CVE-2023-5217

Microsoft is aware and has released patches associated with the two Open-Source Software security vulnerabilities, CVE-2023-4863 and CVE-2023-5217. Through our investigation, we found that these affect a subset of our products and as of today, we have addressed them in our products as outlined...

ASB-A-299477569

In BuildHuffmanTable of huffmanutils.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

Heap Buffer Overflow

napi-rs/image is vulnerable to Heap Buffer Overflow. The vulnerability is due to a remote attacker's ability to perform an out-of-bounds memory write via a crafted webp image resulting in Denial of Service or Code Execution under special circumstances...

Exploit for NULL Pointer Dereference in Gpac

CVE-2023-4683-Test This repo holds an easy to use POC for CVE...

@dweb-browser/desktop (0.1.2), @dweb-browser/js-process (0.1.2) +28 more potentially affected by CVE-2023-5217 via electron (>=25.0.0-beta.1, <=25.8.1)

electron NPM version =25.0.0-beta.1, =8.0.0, =1.0.0, =1.0.0, =0.6.0, =0.0.22, =0.0.93, =0.0.95 - firedev 16.444.5 - firedev-class-helpers 16.444.4 - firedev-config 16.444.4 - firedev-core 16.444.5 - firedev-logger 16.444.4 - firedev-rest 16.444.3 and more Source cves: CVE-2023-5217 Source advisor...

WebM Project WebP Image Library Installed (Linux)

Binary data webmprojectwebpimagelibrarynixinstalled.nbin...

WebM Project WebP Image Library (libwebp) < 1.3.2 Vulnerability

The version of WebM Project WebP Image Library libwebp installed on the remote host is prior to 1.3.2. It is, therefore, affected by a vulnerability: - Heap buffer overflow in libwebp prior to libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a specially crafted...

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

Impact This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you but you should update anyway. Imageflow relies on Google's libwebp library to decode .webp images, an...

GHSA-7VPR-3PPW-QRPJ Imageflow affected by libwebp zero-day and should not be used with malicious source images.

Impact This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you but you should update anyway. Imageflow relies on Google's libwebp library to decode .webp images, an...

GHSA-4VJR-CRVH-383H @napi-rs/image affected by libwebp CVE

Impact Heap buffer overflow in libwebp allows a remote attacker to perform an out of bounds memory write via a crafted webp image. References - https://github.com/advisories/GHSA-j7hp-h8jx-5ppr - https://blog.isosceles.com/the-webp-0day/...

@napi-rs/image affected by libwebp CVE

Impact Heap buffer overflow in libwebp allows a remote attacker to perform an out of bounds memory write via a crafted webp image. References - https://github.com/advisories/GHSA-j7hp-h8jx-5ppr - https://blog.isosceles.com/the-webp-0day/...

Pegasus spyware and how it exploited a WebP vulnerability

Recent events have demonstrated very clearly just how persistent and wide-spread the Pegasus spyware is. For those that have missed the subtle clues, we have tried to construct a clear picture. We attempted to follow the timeline of events, but have made some adjustments to keep the flow of the...