Skip to content
OpenAdvisories
High ELSA-2023-2077 1 CVE

Important: libwebp security update (Oracle Linux 7)

Published May 2, 2023 · Updated May 2, 2023

Ecosystem: Oracle Linux

Summary

[0.3.0-11]
- Added fix for mzbz#1819244

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 7 libwebp 0:0.3.0-11.el7
Oracle Linux · 7 libwebp-devel 0:0.3.0-11.el7
Oracle Linux · 7 libwebp-java 0:0.3.0-11.el7
Oracle Linux · 7 libwebp-tools 0:0.3.0-11.el7

Vulnerabilities 1

  • Medium 5.3
    CVE-2023-1999 Public exploit

    Use after free in libwebp

    There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encode…

    Chromium libwebp thunderbird mozjs38 Debian Ubuntu Azure Linux Alpine