PT-2018-3679 · Google+9 · Libwebp+9

Publicado

2018-11-22

·

Atualizado

2023-02-17

·

CVE-2018-25009

CVSS v3.1

9.1

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Name of the Vulnerable Software and Affected Versions libwebp versions prior to 1.0.1
Description The issue is related to a heap-based buffer overflow in the libwebp library, which is used for encoding and decoding WebP images. This can be exploited by a remote attacker to gain access to sensitive information by creating a specially crafted file. The overflow occurs in the GetLE16() function.
Recommendations For versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the GetLE16() function until a patch is available.

Correção

Out of bounds Read

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

ALSA-2021:4231
ALT-PU-2018-2673
BDU:2021-03097
CESA-2021_4231
CVE-2018-25009
DLA-2677-1
DSA-4930-1
OPENSUSE-SU-2021:1860-1
OPENSUSE-SU-2021_1860-1
RHSA-2021:4231
RHSA-2021_4231
RLSA-2021:4231
SUSE-SU-2021:1830-1
SUSE-SU-2021:1860-1
SUSE-SU-2021_1830-1
SUSE-SU-2021_1860-1
USN-4971-1
USN-4971-2

Produtos afetados

Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Rocky Linux
Suse
Ubuntu
Libwebp