Skip to content
OpenAdvisories
Medium ALAS2-2023-2048 2 CVEs

Moderate: libwebp security update (Amazon Linux 2)

Published May 11, 2023 · Updated Aug 3, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-25014: A flaw was found in libwebp. An unitialized variable is used in function ReadSymbol. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2018-25013: A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes().

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 libwebp 0:0.3.0-10.amzn2.0.2
Amazon Linux · 2 libwebp-debuginfo 0:0.3.0-10.amzn2.0.2
Amazon Linux · 2 libwebp-devel 0:0.3.0-10.amzn2.0.2
Amazon Linux · 2 libwebp-java 0:0.3.0-10.amzn2.0.2
Amazon Linux · 2 libwebp-tools 0:0.3.0-10.amzn2.0.2

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-25013.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-25014.html