Priority CRITICAL 97KEV
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.49013 · Published 2023-09-28 · Partial fix · 117.0.5938.132, 1.13.1 +5 CWE-787
Priority CRITICAL 97KEV
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.99979 · Published 2023-09-12 · Partial fix · 116.0.5845.187, 1.3.2 +14 CWE-787
Priority MEDIUM 49
WebM libvpx (aka the VP8 Codec SDK) before 0.9.5, as used in Google Chrome before 7.0.517.44, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via invalid frames…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04569 · Published 2010-11-05 · Fixed CWE-190
Priority MEDIUM 47
A flaw was found in libwebp in versions before 1.0.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02319 · Published 2021-05-21 · Fixed CWE-416
Priority MEDIUM 47
A flaw was found in libwebp in versions before 1.0.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02662 · Published 2021-05-21 · Fixed CWE-787
Priority MEDIUM 47
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16().
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02513 · Published 2021-05-21 · Fixed CWE-787
Priority MEDIUM 46
A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0223 · Published 2021-05-21 · Partial fix CWE-908
Priority MEDIUM 45
A use-after-free issue was discovered in libwebm through 2018-02-02.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01387 · Published 2018-02-02 · No fix listed CWE-416
Priority MEDIUM 44
A flaw was found in libwebp in versions before 1.0.1.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02302 · Published 2021-05-21 · Partial fix CWE-125
Priority MEDIUM 44
A flaw was found in libwebp in versions before 1.0.1.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0223 · Published 2021-05-21 · Partial fix CWE-125
Priority MEDIUM 44
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02235 · Published 2021-05-21 · Partial fix CWE-125
Priority MEDIUM 43
VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0216 · Published 2023-09-30 · Partial fix CWE-755
Priority MEDIUM 43
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes().
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02051 · Published 2021-05-21 · Partial fix CWE-125
Priority MEDIUM 43
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24().
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02051 · Published 2021-05-21 · Partial fix CWE-125
Priority MEDIUM 43
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16().
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.021 · Published 2021-05-21 · Partial fix CWE-125
Priority MEDIUM 42
The function ParseVP9SuperFrameIndex in common/libwebm_util.cc in libwebm through 2018-01-30 does not validate the child_frame_length data obtained from a .webm file, which allows remote attackers to cause an information…
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.02 · Published 2018-01-30 · Will not fix CWE-125
Priority LOW 37
A flaw was found in libwebp in versions before 1.0.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01966 · Published 2021-05-21 · Partial fix CWE-20
Priority LOW 36
In libwebm before 2019-03-08, a NULL pointer dereference caused by the functions OutputCluster and OutputTracks in webm_info.cc will trigger an abort, which allows a DoS attack, a similar issue to CVE-2018-19212.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01644 · Published 2019-03-13 · No fix listed CWE-476
Priority LOW 36
In libwebp 0.5.1, there is a double free bug in libwebpmux.
CVSS 3.0HIGH 7.5· Network · No auth · User interaction · EPSS 0.01411 · Published 2019-05-23 · No fix listed CWE-415
Priority LOW 35
There exists a use after free/double free in libwebp.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00952 · Published 2023-06-20 · Partial fix · 1.3.1, 1.3.0-8-ga486d800 CWE-416
Priority LOW 30
In libwebm through 2018-10-03, there is an abort caused by libwebm::Webm2Pes::InitWebmParser() that will lead to a DoS attack.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.0086 · Published 2018-11-12 · No fix listed CWE-670
Priority LOW 28
There exists interger overflows in libvpx in versions prior to 1.14.1.
CVSS 4.0MEDIUM 5.9· Network · Low privileges · User interaction · EPSS 0.00814 · Published 2024-06-03 · Partial fix · 1.14.1 CWE-190
Priority LOW 28
VP8 Codec SDK (libvpx) before 1.0.0 "Duclair" allows remote attackers to cause a denial of service (application crash) via (1) unspecified "corrupt input" or (2) by "starting decoding from a P-frame," which triggers an o…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.02502 · Published 2012-02-23 · No fix listed CWE-20
Priority LOW 26
A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx.
CVSS 4.0MEDIUM 5.7· Local · Low privileges · User interaction · EPSS 0.00365 · Published 2024-05-27 · Partial fix · 1.13.1 CWE-122
Priority LOW 16
Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.
CVSS 3.1LOW 3.3· Local · Low privileges · No interaction · EPSS 0.00425 · Published 2017-02-03 · Will not fix CWE-190
THREATIST.IORead the docs