Red Hat Security Advisory: libwebp security update

Fixed packages 6

Vulnerabilities 8

• Unscored —
  CVE-2018-25009

  A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16().

  libwebp libwebp Debian Ubuntu
  May 21, 2021
• Unscored —
  CVE-2018-25010

  A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().

  libwebp libwebp Debian Ubuntu
  May 21, 2021
• Unscored —
  CVE-2018-25012

  A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24().

  libwebp libwebp Debian Ubuntu
  May 21, 2021
• Unscored —
  CVE-2018-25013

  A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes().

  libwebp libwebp Debian Ubuntu
  May 21, 2021
• Unscored —
  CVE-2018-25014

  A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().

  libwebp libwebp Debian Ubuntu
  May 21, 2021
• Unscored —
  CVE-2020-36330

  A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign.…

  libwebp libwebp Debian Ubuntu
  May 21, 2021
• Unscored —
  CVE-2020-36331

  A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The …

  libwebp libwebp Debian Ubuntu
  May 21, 2021
• Unscored —
  CVE-2020-36332

  A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memo…

  libwebp libwebp Debian Ubuntu
  May 21, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1956853
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1956856
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1956868
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1956917
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1956918
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1956922
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1956926
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1956927
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4231.json
• report
  https://access.redhat.com/security/cve/CVE-2018-25009
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-25009
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-25009
• report
  https://access.redhat.com/security/cve/CVE-2018-25010
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-25010
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-25010
• report
  https://access.redhat.com/security/cve/CVE-2018-25012
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-25012
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-25012
• report
  https://access.redhat.com/security/cve/CVE-2018-25013
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-25013
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-25013
• report
  https://access.redhat.com/security/cve/CVE-2018-25014
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-25014
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-25014
• report
  https://access.redhat.com/security/cve/CVE-2020-36330
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-36330
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-36330
• report
  https://access.redhat.com/security/cve/CVE-2020-36331
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-36331
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-36331
• report
  https://access.redhat.com/security/cve/CVE-2020-36332
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-36332
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-36332