Skip to content
OpenAdvisories
Medium DSA-5408-1 1 CVE

libwebp - security update

Published May 21, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 libwebp 0.6.1-2.1+deb11u1

Vulnerabilities 1

  • Medium 5.3
    CVE-2023-1999 Public exploit

    Use after free in libwebp

    There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encode…

    Chromium libwebp thunderbird mozjs38 Debian Ubuntu Azure Linux Alpine