Skip to content
OpenAdvisories
Medium USN-6078-2 1 CVE

libwebp vulnerability

Published Jul 18, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

USN-6078-1 fixed a vulnerability in libwebp. This update
provides the corresponding update for Ubuntu 16.04 LTS.

Original advisory details:

Irvan Kurniawan discovered that libwebp incorrectly handled certain memory
operations. If a user or automated system were tricked into opening a
specially crafted image file, a remote attacker could use this issue to
cause libwebp to crash, resulting in a denial of service, or possibly
execute arbitrary code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS libwebp 0.4.4-1ubuntu0.1~esm2

Vulnerabilities 1

  • Medium 5.3
    CVE-2023-1999 Public exploit

    Use after free in libwebp

    There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encode…

    Chromium libwebp thunderbird mozjs38 Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2023-1999