logo

Database

Out-of-bounds read In pillow

Description

libwebp: OOB write in BuildHuffmanTable Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

1-10 of 50

10

Aliases

1. CVE-2023-48632. NVD-2023-48633. OSV-2023-48634. OSV-ALPINE-2023-48635. OSV-DEBIAN-2023-48636. GCVE-2023-48637. security.gentoo.org8. security.gentoo.org9. SECURITY-TRACKER-CVE-2023-486310. lists.debian.org11. lists.debian.org12. lists.debian.org13. SECURITY-CVE-2023-4863

References

1. https://github.com/qnighy/libwebp-sys2-rs/pull/212. https://github.com/python-pillow/Pillow/pull/73953. https://github.com/jaredforth/webp/pull/304. https://github.com/electron/electron/pull/398235. https://github.com/electron/electron/pull/398256. https://github.com/electron/electron/pull/398267. https://github.com/electron/electron/pull/398278. https://github.com/electron/electron/pull/398289. https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a10. https://github.com/qnighy/libwebp-sys2-rs/commit/4560c473a76ec8bd8c650f19ddf9d7a44f719f8b11. https://github.com/jaredforth/webp/commit/9d4c56e63abecc777df71c702503c3eaabd7dcbc12. https://rustsec.org/advisories/RUSTSEC-2023-0061.html13. https://rustsec.org/advisories/RUSTSEC-2023-0060.html14. https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html#security15. https://news.ycombinator.com/item?id=3747840316. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-486317. https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway18. https://security.netapp.com/advisory/ntap-20230929-001119. https://sethmlarson.dev/security-developer-in-residence-weekly-report-1620. https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-486321. https://www.bentley.com/advisories/be-2023-000122. https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks23. https://www.debian.org/security/2023/dsa-549624. https://www.debian.org/security/2023/dsa-549725. https://www.debian.org/security/2023/dsa-549826. https://www.mozilla.org/en-US/security/advisories/mfsa2023-4027. https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-486328. https://blog.isosceles.com/the-webp-0day29. https://bugzilla.suse.com/show_bug.cgi?id=121523130. https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html31. https://crbug.com/147927432. https://en.bandisoft.com/honeyview/history33. https://github.com/ImageMagick/ImageMagick/discussions/666434. https://github.com/dlemstra/Magick.NET/releases/tag/13.3.035. https://github.com/webmproject/libwebp/releases/tag/v1.3.236. https://lists.fedoraproject.org/archives/list/[email protected]/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT37. https://lists.fedoraproject.org/archives/list/[email protected]/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U64538. https://lists.fedoraproject.org/archives/list/[email protected]/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X339. https://lists.fedoraproject.org/archives/list/[email protected]/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX40. https://lists.fedoraproject.org/archives/list/[email protected]/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX41. https://lists.fedoraproject.org/archives/list/[email protected]/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB42. https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I43. http://www.openwall.com/lists/oss-security/2023/09/21/444. http://www.openwall.com/lists/oss-security/2023/09/22/145. http://www.openwall.com/lists/oss-security/2023/09/22/346. http://www.openwall.com/lists/oss-security/2023/09/22/447. http://www.openwall.com/lists/oss-security/2023/09/22/548. http://www.openwall.com/lists/oss-security/2023/09/22/649. http://www.openwall.com/lists/oss-security/2023/09/22/750. http://www.openwall.com/lists/oss-security/2023/09/22/851. http://www.openwall.com/lists/oss-security/2023/09/26/152. http://www.openwall.com/lists/oss-security/2023/09/26/753. http://www.openwall.com/lists/oss-security/2023/09/28/154. http://www.openwall.com/lists/oss-security/2023/09/28/255. http://www.openwall.com/lists/oss-security/2023/09/28/456. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-486357. https://github.com/mistymntncop/CVE-2023-4863

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.