Skip to content
OpenAdvisories
Medium USN-6078-1 1 CVE

libwebp vulnerability

Published May 16, 2023 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Irvan Kurniawan discovered that libwebp incorrectly handled certain memory
operations. If a user or automated system were tricked into opening a
specially crafted image file, a remote attacker could use this issue to
cause libwebp to crash, resulting in a denial of service, or possibly
execute arbitrary code.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS libwebp 0.6.1-2ubuntu0.18.04.2
Ubuntu · 20.04 LTS 20.04:LTS libwebp 0.6.1-2ubuntu0.20.04.2
Ubuntu · 22.04 LTS 22.04:LTS libwebp 1.2.2-2ubuntu0.22.04.1

Vulnerabilities 1

  • Medium 5.3
    CVE-2023-1999 Public exploit

    Use after free in libwebp

    There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encode…

    Chromium libwebp thunderbird mozjs38 Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2023-1999