Fluid Attacks Database

Description

There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.18	libwebp	>=0.4.2 <1.3.0-r2	1.3.0-r2
rpm rhel8	thunderbird	<0:102.10.0-2.el8_7	0:102.10.0-2.el8_7
alpine v3.15	libwebp	>=0.4.2 <1.2.2-r1	1.2.2-r1
alpine v3.16	libwebp	>=0.4.2 <1.2.3-r1	1.2.3-r1
alpine v3.17	libwebp	>=0.4.2 <1.2.4-r2	1.2.4-r2
alpine v3.19	libwebp	>=0.4.2 <1.3.0-r3	1.3.0-r3
alpine v3.20	libwebp	>=0.4.2 <1.3.0-r3	1.3.0-r3
alpine v3.21	libwebp	>=0.4.2 <1.3.0-r3	1.3.0-r3
alpine v3.22	libwebp	>=0.4.2 <1.3.0-r3	1.3.0-r3
debian 12	firefox-esr	>=0 <102.10.0esr-1	102.10.0esr-1

1-10 of 39

Aliases

1. CVE-2023-19992. NVD-2023-19993. OSV-ALPINE-2023-19994. OSV-2023-19995. OSV-DEBIAN-2023-19996. SECURITY-CVE-2023-19997. SECURITY-TRACKER-CVE-2023-1999

References

1. https://github.com/Pazhanivelmani/webp_Android10_r33_CVE-2023-1999

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.