CVE-2020-36328

The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.

Security Fix(es):

• libwebp: heap-based buffer overflow in PutLE16() (CVE-2018-25011)

• libwebp: heap-based buffer overflow in WebPDecode*Into functions (CVE-2020-36328)

• libwebp: use-after-free in EmitFancyRGB() in dec/io_dec.c (CVE-2020-36329)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

• SECURITY UPDATE: a heap-based buffer overflow
  • debian/patches/CVE-2018-25009.patch: add additional check to avoid read over the header
  • CVE-2018-25009
• SECURITY UPDATE: a heap-based buffer overflow
  • debian/patches/CVE-2018-25010.patch: limit the filter size to not exceed the image dimensions
  • CVE-2018-25010
• SECURITY UPDATE: fail on multiple image chunks
  • debian/patches/CVE-2018-25011.patch: only 1 image chunk allowed
  • CVE-2018-25011
• SECURITY UPDATE: a heap-based buffer overflow
  • debian/patches/CVE-2018-25013_4.patch: wait for all threads to be done in DecodeRemaining.
  • CVE-2018-25013
  • CVE-2018-25014
• SECURITY UPDATE: a heap-based buffer overflow
  • debian/patches/CVE-2020-36328.patch: fix invalid check for buffer size
  • CVE-2020-36328
• SECURITY UPDATE: a use-after-free was found due to a thread being killed too early
  • debian/patches/CVE-2020-36329.patch: fix for thread race heap-use-after-free
  • CVE-2020-36329
• SECURITY UPDATE: an out-of-bounds read
  • debian/patches/CVE-2020-36330.patch: fix riff size checks
  • CVE-2020-36330
• SECURITY UPDATE: an out-of-bounds read
  • debian/patches/CVE-2020-36331.patch: validate chunk_size
  • CVE-2020-36331
• SECURITY UPDATE: a use after free/double free
  • debian/patches/CVE-2023-1999.patch: clear result->bw on error
  • CVE-2023-1999

• CVE-2020-36328: fix a heap-based buffer overflow in WebPDecode*Into functions

• CVE-2020-36328: fix a heap-based buffer overflow in WebPDecode*Into functions

This update for libwebp fixes the following issues:

• CVE-2018-25010: Fixed heap-based buffer overflow in ApplyFilter() (bsc#1185685).
• CVE-2020-36330: Fixed heap-based buffer overflow in ChunkVerifyAndAssign() (bsc#1185691).
• CVE-2020-36332: Fixed extreme memory allocation when reading a file (bsc#1185674).
• CVE-2020-36329: Fixed use-after-free in EmitFancyRGB() (bsc#1185652).
• CVE-2018-25012: Fixed heap-based buffer overflow in GetLE24() (bsc#1185690).
• CVE-2020-36328: Fixed heap-based buffer overflow in WebPDecode*Into functions (bsc#1185688).
• CVE-2018-25013: Fixed heap-based buffer overflow in ShiftBytes() (bsc#1185654).
• CVE-2020-36331: Fixed heap-based buffer overflow in ChunkAssignData() (bsc#1185686).
• CVE-2018-25009: Fixed heap-based buffer overflow in GetLE16() (bsc#1185673).
• CVE-2018-25011: Fixed fail on multiple image chunks (bsc#1186247).

This update for libwebp fixes the following issues:

• CVE-2018-25010: Fixed heap-based buffer overflow in ApplyFilter() (bsc#1185685).
• CVE-2020-36330: Fixed heap-based buffer overflow in ChunkVerifyAndAssign() (bsc#1185691).
• CVE-2020-36332: Fixed extreme memory allocation when reading a file (bsc#1185674).
• CVE-2020-36329: Fixed use-after-free in EmitFancyRGB() (bsc#1185652).
• CVE-2018-25012: Fixed heap-based buffer overflow in GetLE24() (bsc#1185690).
• CVE-2020-36328: Fixed heap-based buffer overflow in WebPDecode*Into functions (bsc#1185688).
• CVE-2018-25013: Fixed heap-based buffer overflow in ShiftBytes() (bsc#1185654).
• CVE-2020-36331: Fixed heap-based buffer overflow in ChunkAssignData() (bsc#1185686).
• CVE-2018-25009: Fixed heap-based buffer overflow in GetLE16() (bsc#1185673).
• CVE-2018-25011: Fixed fail on multiple image chunks (bsc#1186247).

It was discovered that libwebp incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image file, a remote attacker could use this issue to cause libwebp to crash, resulting in a denial of service, or possibly execute arbitrary code.

USN-4971-1 fixed several vulnerabilities in libwebp. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that libwebp incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image file, a remote attacker could use this issue to cause libwebp to crash, resulting in a denial of service, or possibly execute arbitrary code.