PT-2020-6122 · Google+8 · Libwebp+8

Published 2018-11-22 · Updated 2023-01-09 · CVE-2020-36329

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libwebp versions prior to 1.0.1

Description A flaw was found in libwebp due to a use-after-free caused by a thread being killed too early. The highest threat from this issue is to data confidentiality and integrity as well as system availability. Exploitation of the flaw may allow a remote attacker to execute arbitrary code by creating a specially crafted file.

Recommendations For versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of libwebp until a patch is applied.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2018-2673

BDU:2021-03101

CESA-2021_2328

CESA-2021_2354

CVE-2020-36329

DLA-2677-1

DSA-4930-1

OPENSUSE-SU-2021:1860-1

OPENSUSE-SU-2021_1860-1

RHSA-2021:2260

RHSA-2021:2328

RHSA-2021:2354

RHSA-2021:2364

RHSA-2021:2365

RHSA-2021_2260

RHSA-2021_2328

RHSA-2021_2354

RLSA-2021:2354

SUSE-SU-2021:1830-1

SUSE-SU-2021:1860-1

USN-4971-1

USN-4971-2

Affected Products

Alt Linux

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

Libwebp

References · 81

• https://errata.rockylinux.org/RLSA-2021:2354 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-2328.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36328 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1860-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4971-1 · Vendor Advisory
• https://debian.org/security/2021/dsa-4930 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2677-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4971-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1956843 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-36329 · Security Note
• https://ubuntu.com/security/CVE-2018-25009 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-25010 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:2354 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-2354.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1860-1 · Vendor Advisory