CVE-2020-36331

The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.

Security Fix(es):

• libwebp: out-of-bounds read in WebPMuxCreateInternal (CVE-2018-25009)

• libwebp: out-of-bounds read in ApplyFilter() (CVE-2018-25010)

• libwebp: out-of-bounds read in WebPMuxCreateInternal() (CVE-2018-25012)

• libwebp: out-of-bounds read in ShiftBytes() (CVE-2018-25013)

• libwebp: use of uninitialized value in ReadSymbol() (CVE-2018-25014)

• libwebp: out-of-bounds read in ChunkVerifyAndAssign() in mux/muxread.c (CVE-2020-36330)

• libwebp: out-of-bounds read in ChunkAssignData() in mux/muxinternal.c (CVE-2020-36331)

• libwebp: excessive memory allocation when reading a file (CVE-2020-36332)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability is to data confidentiality and to the service availability.

The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.

Security Fix(es):

• libwebp: out-of-bounds read in WebPMuxCreateInternal (CVE-2018-25009)

• libwebp: out-of-bounds read in ApplyFilter() (CVE-2018-25010)

• libwebp: out-of-bounds read in WebPMuxCreateInternal() (CVE-2018-25012)

• libwebp: out-of-bounds read in ShiftBytes() (CVE-2018-25013)

• libwebp: use of uninitialized value in ReadSymbol() (CVE-2018-25014)

• libwebp: out-of-bounds read in ChunkVerifyAndAssign() in mux/muxread.c (CVE-2020-36330)

• libwebp: out-of-bounds read in ChunkAssignData() in mux/muxinternal.c (CVE-2020-36331)

• libwebp: excessive memory allocation when reading a file (CVE-2020-36332)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• SECURITY UPDATE: a heap-based buffer overflow
  • debian/patches/CVE-2018-25009.patch: add additional check to avoid read over the header
  • CVE-2018-25009
• SECURITY UPDATE: a heap-based buffer overflow
  • debian/patches/CVE-2018-25010.patch: limit the filter size to not exceed the image dimensions
  • CVE-2018-25010
• SECURITY UPDATE: fail on multiple image chunks
  • debian/patches/CVE-2018-25011.patch: only 1 image chunk allowed
  • CVE-2018-25011
• SECURITY UPDATE: a heap-based buffer overflow
  • debian/patches/CVE-2018-25013_4.patch: wait for all threads to be done in DecodeRemaining.
  • CVE-2018-25013
  • CVE-2018-25014
• SECURITY UPDATE: a heap-based buffer overflow
  • debian/patches/CVE-2020-36328.patch: fix invalid check for buffer size
  • CVE-2020-36328
• SECURITY UPDATE: a use-after-free was found due to a thread being killed too early
  • debian/patches/CVE-2020-36329.patch: fix for thread race heap-use-after-free
  • CVE-2020-36329
• SECURITY UPDATE: an out-of-bounds read
  • debian/patches/CVE-2020-36330.patch: fix riff size checks
  • CVE-2020-36330
• SECURITY UPDATE: an out-of-bounds read
  • debian/patches/CVE-2020-36331.patch: validate chunk_size
  • CVE-2020-36331
• SECURITY UPDATE: a use after free/double free
  • debian/patches/CVE-2023-1999.patch: clear result->bw on error
  • CVE-2023-1999

• CVE-2020-36329: fix use-after-free vulnerability by delaying thread termination
• CVE-2020-36330: fix out-of-bounds read in ChunkVerifyAndAssign function
• CVE-2020-36331: fix out-of-bounds read in ChunkAssignData function

• CVE-2020-36329: fix use-after-free vulnerability by delaying thread termination
• CVE-2020-36330: fix out-of-bounds read in ChunkVerifyAndAssign function
• CVE-2020-36331: fix out-of-bounds read in ChunkAssignData function

This update for libwebp fixes the following issues:

• CVE-2018-25010: Fixed heap-based buffer overflow in ApplyFilter() (bsc#1185685).
• CVE-2020-36330: Fixed heap-based buffer overflow in ChunkVerifyAndAssign() (bsc#1185691).
• CVE-2020-36332: Fixed extreme memory allocation when reading a file (bsc#1185674).
• CVE-2020-36329: Fixed use-after-free in EmitFancyRGB() (bsc#1185652).
• CVE-2018-25012: Fixed heap-based buffer overflow in GetLE24() (bsc#1185690).
• CVE-2020-36328: Fixed heap-based buffer overflow in WebPDecode*Into functions (bsc#1185688).
• CVE-2018-25013: Fixed heap-based buffer overflow in ShiftBytes() (bsc#1185654).
• CVE-2020-36331: Fixed heap-based buffer overflow in ChunkAssignData() (bsc#1185686).
• CVE-2018-25009: Fixed heap-based buffer overflow in GetLE16() (bsc#1185673).
• CVE-2018-25011: Fixed fail on multiple image chunks (bsc#1186247).

This update for libwebp fixes the following issues:

• CVE-2018-25010: Fixed heap-based buffer overflow in ApplyFilter() (bsc#1185685).
• CVE-2020-36330: Fixed heap-based buffer overflow in ChunkVerifyAndAssign() (bsc#1185691).
• CVE-2020-36332: Fixed extreme memory allocation when reading a file (bsc#1185674).
• CVE-2020-36329: Fixed use-after-free in EmitFancyRGB() (bsc#1185652).
• CVE-2018-25012: Fixed heap-based buffer overflow in GetLE24() (bsc#1185690).
• CVE-2018-25013: Fixed heap-based buffer overflow in ShiftBytes() (bsc#1185654).
• CVE-2020-36331: Fixed heap-based buffer overflow in ChunkAssignData() (bsc#1185686).
• CVE-2018-25009: Fixed heap-based buffer overflow in GetLE16() (bsc#1185673).
• CVE-2018-25011: Fixed fail on multiple image chunks (bsc#1186247).

This update for libwebp fixes the following issues:

• CVE-2018-25010: Fixed heap-based buffer overflow in ApplyFilter() (bsc#1185685).
• CVE-2020-36330: Fixed heap-based buffer overflow in ChunkVerifyAndAssign() (bsc#1185691).
• CVE-2020-36332: Fixed extreme memory allocation when reading a file (bsc#1185674).
• CVE-2020-36329: Fixed use-after-free in EmitFancyRGB() (bsc#1185652).
• CVE-2018-25012: Fixed heap-based buffer overflow in GetLE24() (bsc#1185690).
• CVE-2020-36328: Fixed heap-based buffer overflow in WebPDecode*Into functions (bsc#1185688).
• CVE-2018-25013: Fixed heap-based buffer overflow in ShiftBytes() (bsc#1185654).
• CVE-2020-36331: Fixed heap-based buffer overflow in ChunkAssignData() (bsc#1185686).
• CVE-2018-25009: Fixed heap-based buffer overflow in GetLE16() (bsc#1185673).
• CVE-2018-25011: Fixed fail on multiple image chunks (bsc#1186247).

It was discovered that libwebp incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image file, a remote attacker could use this issue to cause libwebp to crash, resulting in a denial of service, or possibly execute arbitrary code.

USN-4971-1 fixed several vulnerabilities in libwebp. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that libwebp incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image file, a remote attacker could use this issue to cause libwebp to crash, resulting in a denial of service, or possibly execute arbitrary code.