Red Hat Security Advisory

RHSA-2021:4231

libwebp security update

Released 2021-11-09 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) libwebp-1.0.0-5.el8, libwebp-devel-1.0.0-5.el8

TI-2018-15241 CVE-2018-25014 · GHSA-rr28-4v9r-6wcq

MEDIUM 46

A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0223 Published 2021-05-21 Partial fix CWE-908

TI-2020-18614 CVE-2020-36331 · GHSA-hrq2-3wxg-w5m6

MEDIUM 44

A flaw was found in libwebp in versions before 1.0.1.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02302 Published 2021-05-21 Partial fix CWE-125

TI-2020-18613 CVE-2020-36330 · GHSA-478j-8hp8-fjpw

MEDIUM 44

A flaw was found in libwebp in versions before 1.0.1.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0223 Published 2021-05-21 Partial fix CWE-125

TI-2018-15237 CVE-2018-25010 · GHSA-g4fc-9486-f3m2

MEDIUM 44

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02235 Published 2021-05-21 Partial fix CWE-125

TI-2018-15240 CVE-2018-25013 · GHSA-xj9f-6qqc-cpfp

MEDIUM 43

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes().

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02051 Published 2021-05-21 Partial fix CWE-125

TI-2018-15239 CVE-2018-25012 · GHSA-x5pq-pm4r-vx73

MEDIUM 43

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24().

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02051 Published 2021-05-21 Partial fix CWE-125

TI-2018-15236 CVE-2018-25009 · GHSA-3rw8-24h2-6px6

MEDIUM 43

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16().

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.021 Published 2021-05-21 Partial fix CWE-125

TI-2020-18615 CVE-2020-36332 · GHSA-fx92-p77r-3r2c

LOW 37

A flaw was found in libwebp in versions before 1.0.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01966 Published 2021-05-21 Partial fix CWE-20