CVE-2020-36330

CVE-2020-36330 describes an out-of-bounds read in libwebp prior to version 1.0.1, triggered in the ChunkVerifyAndAssign function. The documented impact is data confidentiality loss and reduced availability. Public references in the Connected documents corroborate the flaw in libwebp and align wit...

CVE-2018-25013

CVE-2018-25013 is a heap-based buffer overflow in libwebp’s ShiftBytes() found in versions before 1.0.1. The issue affects libwebp (WebP codec library) and can lead to memory corruption in image processing. Public references in multiple advisories confirm the vulnerability and recommend upgrading...

CVE-2020-36328

CVE-2020-36328 concerns a heap-based buffer overflow in libwebp where WebPDecodeRGBInto may overflow due to an invalid buffer-size check, impacting data confidentiality, integrity, and availability. It affects versions before 1.0.1; multiple connected advisories confirm the same root cause and ve...

CVE-2018-25009

CVE-2018-25009 is a heap-based buffer overflow in libwebp GetLE16() affecting versions before 1.0.1. The issue can lead to memory corruption with potential impact on confidentiality/availability. Mitigation: upgrade libwebp to 1.0.1 or later; several advisories document this fix across distributi...

CVE-2018-25012

CVE-2018-25012 : A heap-based buffer overflow is present in libwebp’s GetLE24() in versions prior to 1.0.1. Affected component: libwebp library. Remediation: upgrade to libwebp 1.0.1 or newer (various advisories note this patch). Note: connected documents corroborate the issue across multiple ven...

CVE-2020-36329

CVE-2020-36329 is a libwebp use-after-free vulnerability present in versions before 1.0.1, caused by a thread being killed too early. The impact can affect data confidentiality, integrity, and system availability. Remediation is via updates/patches provided by distributions; notable fixes include...

CVE-2018-25011

CVE-2018-25011 affects libwebp prior to 1.0.1. Root cause: heap-based buffer overflow in PutLE16() that can affect data confidentiality, integrity, and availability. Documentation indicates a patch/update to version 1.0.1 or later; downstream advisories reference this fix in various Linux distrib...

CVE-2020-36331

CVE-2020-36331 affects libwebp prior to 1.0.1, with an out-of-bounds read in the ChunkAssignData path (mux/muxinternal.c). The vulnerability impacts data confidentiality and availability. Public documents confirm the root cause as out-of-bounds read in the specified function, and multiple advisor...

CVE-2018-25010

CVE-2018-25010 affects libwebp; a heap-based buffer overflow occurs in ApplyFilter() in versions before 1.0.1. Public documents consistently describe an out-of-bounds condition in libwebp that can crash the library and potentially enable arbitrary code execution. Affected advisories and vendor bu...

CVE-2018-25014

CVE-2018-25014 affects the libwebp library: a use of an uninitialized value is present in ReadSymbol() in versions before 1.0.1. The issue is documented across multiple advisories (e.g., ALAS2/AlmaLinux notices) and is associated with libwebp data integrity/confidentiality/availability risks. A f...