Skip to content
OpenAdvisories
High ALAS2023-2023-185 1 CVE

Important: libwebp security update (Amazon Linux 2023)

Published May 25, 2023 · Updated Jun 7, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1999: A double-free in libwebp could have led to memory corruption and a potentially exploitable crash.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2023 libwebp 0:1.2.4-1.amzn2023.0.4
Amazon Linux · 2023 libwebp-debuginfo 0:1.2.4-1.amzn2023.0.4
Amazon Linux · 2023 libwebp-debugsource 0:1.2.4-1.amzn2023.0.4
Amazon Linux · 2023 libwebp-devel 0:1.2.4-1.amzn2023.0.4
Amazon Linux · 2023 libwebp-java 0:1.2.4-1.amzn2023.0.4
Amazon Linux · 2023 libwebp-java-debuginfo 0:1.2.4-1.amzn2023.0.4
Amazon Linux · 2023 libwebp-tools 0:1.2.4-1.amzn2023.0.4
Amazon Linux · 2023 libwebp-tools-debuginfo 0:1.2.4-1.amzn2023.0.4

Vulnerabilities 1

  • Medium 5.3
    CVE-2023-1999 Public exploit

    Use after free in libwebp

    There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encode…

    Chromium libwebp thunderbird mozjs38 Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-1999.html