CVE-2023-1999

Name
CVE-2023-1999
Description
There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://chromium.googlesource.com/webm/libwebp
MISC https://security.gentoo.org/glsa/202309-05

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:webmproject:libwebp:*:*:*:*:*:*:*:* libwebp >= 0.4.2 < 1.3.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
libwebp edge-main 1.3.0-r3 Natanael Copa <ncopa@alpinelinux.org> fixed
libwebp 3.22-main 1.3.0-r3 None fixed
libwebp 3.21-main 1.3.0-r3 None fixed
libwebp 3.20-main 1.3.0-r3 None fixed
libwebp 3.19-main 1.3.0-r3 None fixed
libwebp 3.18-main 1.3.0-r2 Natanael Copa <ncopa@alpinelinux.org> fixed
libwebp 3.17-main 1.2.4-r3 Natanael Copa <ncopa@alpinelinux.org> fixed
libwebp 3.17-main 1.2.4-r2 Natanael Copa <ncopa@alpinelinux.org> fixed
firefox-esr edge-community 102.10.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
firefox-esr 3.22-community 102.10.0-r0 None fixed
firefox-esr 3.21-community 102.10.0-r0 None fixed
firefox-esr 3.20-community 102.10.0-r0 None fixed
firefox-esr 3.19-community 102.10.0-r0 None fixed
firefox-esr 3.18-community 102.10.0-r0 None fixed