CVE-2018-25014

The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.

Security Fix(es):

• libwebp: out-of-bounds read in WebPMuxCreateInternal (CVE-2018-25009)

• libwebp: out-of-bounds read in ApplyFilter() (CVE-2018-25010)

• libwebp: out-of-bounds read in WebPMuxCreateInternal() (CVE-2018-25012)

• libwebp: out-of-bounds read in ShiftBytes() (CVE-2018-25013)

• libwebp: use of uninitialized value in ReadSymbol() (CVE-2018-25014)

• libwebp: out-of-bounds read in ChunkVerifyAndAssign() in mux/muxread.c (CVE-2020-36330)

• libwebp: out-of-bounds read in ChunkAssignData() in mux/muxinternal.c (CVE-2020-36331)

• libwebp: excessive memory allocation when reading a file (CVE-2020-36332)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().

The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.

Security Fix(es):

• libwebp: out-of-bounds read in WebPMuxCreateInternal (CVE-2018-25009)

• libwebp: out-of-bounds read in ApplyFilter() (CVE-2018-25010)

• libwebp: out-of-bounds read in WebPMuxCreateInternal() (CVE-2018-25012)

• libwebp: out-of-bounds read in ShiftBytes() (CVE-2018-25013)

• libwebp: use of uninitialized value in ReadSymbol() (CVE-2018-25014)

• libwebp: out-of-bounds read in ChunkVerifyAndAssign() in mux/muxread.c (CVE-2020-36330)

• libwebp: out-of-bounds read in ChunkAssignData() in mux/muxinternal.c (CVE-2020-36331)

• libwebp: excessive memory allocation when reading a file (CVE-2020-36332)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• SECURITY UPDATE: a heap-based buffer overflow
  • debian/patches/CVE-2018-25009.patch: add additional check to avoid read over the header
  • CVE-2018-25009
• SECURITY UPDATE: a heap-based buffer overflow
  • debian/patches/CVE-2018-25010.patch: limit the filter size to not exceed the image dimensions
  • CVE-2018-25010
• SECURITY UPDATE: fail on multiple image chunks
  • debian/patches/CVE-2018-25011.patch: only 1 image chunk allowed
  • CVE-2018-25011
• SECURITY UPDATE: a heap-based buffer overflow
  • debian/patches/CVE-2018-25013_4.patch: wait for all threads to be done in DecodeRemaining.
  • CVE-2018-25013
  • CVE-2018-25014
• SECURITY UPDATE: a heap-based buffer overflow
  • debian/patches/CVE-2020-36328.patch: fix invalid check for buffer size
  • CVE-2020-36328
• SECURITY UPDATE: a use-after-free was found due to a thread being killed too early
  • debian/patches/CVE-2020-36329.patch: fix for thread race heap-use-after-free
  • CVE-2020-36329
• SECURITY UPDATE: an out-of-bounds read
  • debian/patches/CVE-2020-36330.patch: fix riff size checks
  • CVE-2020-36330
• SECURITY UPDATE: an out-of-bounds read
  • debian/patches/CVE-2020-36331.patch: validate chunk_size
  • CVE-2020-36331
• SECURITY UPDATE: a use after free/double free
  • debian/patches/CVE-2023-1999.patch: clear result->bw on error
  • CVE-2023-1999

• CVE-2018-25013, CVE-2018-25014: wait for all threads to be done in DecodeRemaining
• CVE-2023-1999: fix a double free error

• CVE-2018-25013, CVE-2018-25014: wait for all threads to be done in DecodeRemaining
• CVE-2023-1999: fix a double free error

• CVE-2018-25013, CVE-2018-25014: wait for all threads to be done in DecodeRemaining, make sure partition #0 is read before VP8 data

• CVE-2018-25009: fix out-of-bounds read in GetLE16() by validating VP8X chunk size
• CVE-2018-25010: fix heap-based buffer overflow in ApplyFilter() by limiting filter radius to image dimensions
• CVE-2018-25011: fix heap-based buffer overflow in PutLE16() by rejecting multiple image chunks in ANMF frames
• CVE-2018-25012: fix out-of-bounds read in GetLE24() by validating VP8X chunk size
• CVE-2018-25013: fix heap-based buffer overflow in ShiftBytes() by synchronizing threads in DecodeRemaining
• CVE-2018-25014: fix use of uninitialized value in ReadSymbol() by validating decoder readiness and synchronizing threads

• CVE-2018-25009: fix out-of-bounds read in GetLE16() by validating VP8X chunk size
• CVE-2018-25010: fix heap-based buffer overflow in ApplyFilter() by limiting filter radius to image dimensions
• CVE-2018-25011: fix heap-based buffer overflow in PutLE16() by rejecting multiple image chunks in ANMF frames
• CVE-2018-25012: fix out-of-bounds read in GetLE24() by validating VP8X chunk size
• CVE-2018-25013: fix heap-based buffer overflow in ShiftBytes() by synchronizing threads in DecodeRemaining
• CVE-2018-25014: fix use of uninitialized value in ReadSymbol() by validating decoder readiness and synchronizing threads

It was discovered that libwebp incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image file, a remote attacker could use this issue to cause libwebp to crash, resulting in a denial of service, or possibly execute arbitrary code.

USN-4971-1 fixed several vulnerabilities in libwebp. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that libwebp incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image file, a remote attacker could use this issue to cause libwebp to crash, resulting in a denial of service, or possibly execute arbitrary code.