Skip to content
OpenAdvisories
Medium ALAS2-2023-2031 2 CVEs

Moderate: libwebp security update (Amazon Linux 2)

Published Apr 27, 2023 · Updated May 2, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-36331: A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability is to data confidentiality and to the service availability. CVE-2020-36330: A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the service availability.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 libwebp 0:0.3.0-10.amzn2.0.1
Amazon Linux · 2 libwebp-debuginfo 0:0.3.0-10.amzn2.0.1
Amazon Linux · 2 libwebp-devel 0:0.3.0-10.amzn2.0.1
Amazon Linux · 2 libwebp-java 0:0.3.0-10.amzn2.0.1
Amazon Linux · 2 libwebp-tools 0:0.3.0-10.amzn2.0.1

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-36330.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-36331.html