PT-2018-3683 · Google+9 · Libwebp+9

Publicado

2018-11-22

·

Atualizado

2023-02-09

·

CVE-2018-25013

CVSS v3.1

9.1

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Name of the Vulnerable Software and Affected Versions libwebp versions prior to 1.0.1
Description A heap-based buffer overflow was found in libwebp, related to a buffer overflow issue when reading beyond the buffer boundaries in memory. This issue can be exploited by a remote attacker to gain access to confidential information by creating a specially crafted file.
Recommendations For versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ShiftBytes() function until a patch is available.

Correção

Out of bounds Read

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

ALSA-2021:4231
ALT-PU-2018-2673
BDU:2021-03103
CESA-2021_4231
CVE-2018-25013
DLA-2677-1
DSA-4930-1
OPENSUSE-SU-2021:1860-1
OPENSUSE-SU-2021_1860-1
RHSA-2021:4231
RHSA-2021_4231
RLSA-2021:4231
SUSE-SU-2021:1830-1
SUSE-SU-2021:1860-1
USN-4971-1
USN-4971-2

Produtos afetados

Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Rocky Linux
Suse
Ubuntu
Libwebp