PT-2018-3684 · Google+8 · Libwebp+8

Guilherme De Almeida Suckevicz · Published 2018-08-20 · Updated 2023-02-09 · CVE-2018-25014

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libwebp versions prior to 1.0.1

Description The issue is related to the use of an uninitialized variable in the libwebp library, which is used for encoding and decoding WebP images. This could allow a remote attacker to execute arbitrary code. The problem is specifically found in the ReadSymbol() function.

Recommendations For libwebp versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ReadSymbol() function until a patch is available.

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-457

CWE-908

Related Identifiers

ALSA-2021:4231

ALT-PU-2018-2673

BDU:2021-03106

CESA-2021_2328

CESA-2021_4231

CVE-2018-25014

DLA-2677-1

DSA-4930-1

RHSA-2021:2328

RHSA-2021:4231

RHSA-2021_2328

RHSA-2021_4231

RLSA-2021:4231

USN-4971-1

USN-4971-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Ubuntu

Libwebp

References · 112

• https://wiki.astralinux.ru/pages/viewpage.action?pageId=153487325 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03103 · Security Note
• https://bdu.fstec.ru/vul/2021-03098 · Security Note
• https://osv.dev/vulnerability/USN-4971-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:4231 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:4231 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36329 · Security Note
• https://ubuntu.com/security/CVE-2020-36332 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36329 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-25014 · Security Note
• https://errata.rockylinux.org/RLSA-2021:4231 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-25014 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03106 · Security Note
• http://repo.red-soft.ru/redos/7.2c/x86_64/updates · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4930-1 · Vendor Advisory