UbuntuUpdates.org

Package "libwebpmux3"

Name: libwebpmux3

Description:

Lossy compression of digital photographic images.
Latest version: 0.6.1-2ubuntu0.18.04.2
Release: bionic (18.04)
Level: security
Repository: main
Head package: libwebp
Homepage: https://developers.google.com/speed/webp/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libwebpmux3"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libwebpmux3" in Bionic

Repository Area Version
base main 0.6.1-2
updates main 0.6.1-2ubuntu0.18.04.2

Changelog

Version: 0.6.1-2ubuntu0.18.04.2 2023-05-16 17:11:34 UTC

  libwebp (0.6.1-2ubuntu0.18.04.2) bionic-security; urgency=medium

  * SECURITY UPDATE: crash and possible code execution via double free
    - debian/patches/CVE-2023-1999.patch: clear result->bw on error in
      src/enc/alpha_enc.c.
    - CVE-2023-1999

 -- Marc Deslauriers <email address hidden> Mon, 15 May 2023 14:14:38 -0400
Source diff to previous version

Version: 0.6.1-2ubuntu0.18.04.1 2021-06-01 13:06:19 UTC

  libwebp (0.6.1-2ubuntu0.18.04.1) bionic-security; urgency=medium

  * SECURITY UPDATE: heap-based buffer overflow in GetLE16() and GetLE24()
    - debian/patches/CVE-2018-25009.patch: check data_size in
      src/mux/muxread.c.
    - CVE-2018-25009
    - CVE-2018-25012
  * SECURITY UPDATE: heap-based buffer overflow in ApplyFilter()
    - debian/patches/CVE-2018-25010.patch: limit the filter size in
      src/utils/quant_levels_dec_utils.c.
    - CVE-2018-25010
  * SECURITY UPDATE: heap-based buffer overflow in PutLE16()
    - debian/patches/CVE-2018-25011.patch: limit number of image chunks in
      src/mux/muxread.c.
    - CVE-2018-25011
  * SECURITY UPDATE: heap-based buffer overflow in ShiftBytes() and in
    ReadSymbol()
    - debian/patches/CVE-2018-25013_4.patch: wait for all threads to be
      done in DecodeRemaining in src/dec/idec_dec.c.
    - CVE-2018-25013
    - CVE-2018-25014
  * SECURITY UPDATE: heap-based buffer overflow in WebPDecode*Into functions
    - debian/patches/CVE-2020-36328.patch: fix buffer size check in
      src/dec/buffer_dec.c.
    - CVE-2020-36328
  * SECURITY UPDATE: use-after-free in EmitFancyRGB()
    - debian/patches/CVE-2020-36329.patch: fix thread race
      heap-use-after-free in src/dec/idec_dec.c.
    - CVE-2020-36329
  * SECURITY UPDATE: heap-based buffer overflow in ChunkVerifyAndAssign()
    - debian/patches/CVE-2020-36330.patch: fix riff size checks in
      src/mux/muxread.c.
    - CVE-2020-36330
  * SECURITY UPDATE: heap-based buffer overflow in ChunkAssignData()
    - debian/patches/CVE-2020-36331.patch: validate chunk_size in
      src/mux/muxi.h, src/mux/muxread.c.
    - CVE-2020-36331
  * SECURITY UPDATE: extreme memory allocation when reading a file
    - debian/patches/CVE-2020-36332-pre1.patch: limit memory allocation
      when reading invalid Huffman codes in src/dec/vp8l_dec.c.
    - debian/patches/CVE-2020-36332.patch: better handling of bogus Huffman
      codes in src/dec/vp8l_dec.c.
    - CVE-2020-36332

 -- Marc Deslauriers <email address hidden> Thu, 20 May 2021 07:52:26 -0400
CVE-2018-25009 A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function WebPMuxCreateInternal. The highest threat from this
CVE-2018-25012 A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function WebPMuxCreateInternal. The highest threat from this
CVE-2018-25010 A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ApplyFilter. The highest threat from this vulnerabi
CVE-2018-25011 A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow was found in PutLE16(). The highest threat from this vulnerability
CVE-2018-25013 A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ShiftBytes. The highest threat from this vulnerabil
CVE-2018-25014 A flaw was found in libwebp in versions before 1.0.1. An unitialized variable is used in function ReadSymbol. The highest threat from this vulnerabil
CVE-2020-36328 A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check
CVE-2020-36329 A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early. The highest threat from this
CVE-2020-36330 A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this
CVE-2020-36331 A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulne
CVE-2020-36332 A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threat from th


About   -   Send Feedback to @ubuntu_updates