CVE-2018-25011

The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.

Security Fix(es):

• libwebp: heap-based buffer overflow in PutLE16() (CVE-2018-25011)

• libwebp: heap-based buffer overflow in WebPDecode*Into functions (CVE-2020-36328)

• libwebp: use-after-free in EmitFancyRGB() in dec/io_dec.c (CVE-2020-36329)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16().

• SECURITY UPDATE: a heap-based buffer overflow
  • debian/patches/CVE-2018-25009.patch: add additional check to avoid read over the header
  • CVE-2018-25009
• SECURITY UPDATE: a heap-based buffer overflow
  • debian/patches/CVE-2018-25010.patch: limit the filter size to not exceed the image dimensions
  • CVE-2018-25010
• SECURITY UPDATE: fail on multiple image chunks
  • debian/patches/CVE-2018-25011.patch: only 1 image chunk allowed
  • CVE-2018-25011
• SECURITY UPDATE: a heap-based buffer overflow
  • debian/patches/CVE-2018-25013_4.patch: wait for all threads to be done in DecodeRemaining.
  • CVE-2018-25013
  • CVE-2018-25014
• SECURITY UPDATE: a heap-based buffer overflow
  • debian/patches/CVE-2020-36328.patch: fix invalid check for buffer size
  • CVE-2020-36328
• SECURITY UPDATE: a use-after-free was found due to a thread being killed too early
  • debian/patches/CVE-2020-36329.patch: fix for thread race heap-use-after-free
  • CVE-2020-36329
• SECURITY UPDATE: an out-of-bounds read
  • debian/patches/CVE-2020-36330.patch: fix riff size checks
  • CVE-2020-36330
• SECURITY UPDATE: an out-of-bounds read
  • debian/patches/CVE-2020-36331.patch: validate chunk_size
  • CVE-2020-36331
• SECURITY UPDATE: a use after free/double free
  • debian/patches/CVE-2023-1999.patch: clear result->bw on error
  • CVE-2023-1999

• CVE-2018-25009: fix out-of-bounds read in GetLE16() by validating VP8X chunk size
• CVE-2018-25010: fix heap-based buffer overflow in ApplyFilter() by limiting filter radius to image dimensions
• CVE-2018-25011: fix heap-based buffer overflow in PutLE16() by rejecting multiple image chunks in ANMF frames
• CVE-2018-25012: fix out-of-bounds read in GetLE24() by validating VP8X chunk size
• CVE-2018-25013: fix heap-based buffer overflow in ShiftBytes() by synchronizing threads in DecodeRemaining
• CVE-2018-25014: fix use of uninitialized value in ReadSymbol() by validating decoder readiness and synchronizing threads

• CVE-2018-25009: fix out-of-bounds read in GetLE16() by validating VP8X chunk size
• CVE-2018-25010: fix heap-based buffer overflow in ApplyFilter() by limiting filter radius to image dimensions
• CVE-2018-25011: fix heap-based buffer overflow in PutLE16() by rejecting multiple image chunks in ANMF frames
• CVE-2018-25012: fix out-of-bounds read in GetLE24() by validating VP8X chunk size
• CVE-2018-25013: fix heap-based buffer overflow in ShiftBytes() by synchronizing threads in DecodeRemaining
• CVE-2018-25014: fix use of uninitialized value in ReadSymbol() by validating decoder readiness and synchronizing threads

This update for libwebp fixes the following issues:

• CVE-2018-25010: Fixed heap-based buffer overflow in ApplyFilter() (bsc#1185685).
• CVE-2020-36330: Fixed heap-based buffer overflow in ChunkVerifyAndAssign() (bsc#1185691).
• CVE-2020-36332: Fixed extreme memory allocation when reading a file (bsc#1185674).
• CVE-2020-36329: Fixed use-after-free in EmitFancyRGB() (bsc#1185652).
• CVE-2018-25012: Fixed heap-based buffer overflow in GetLE24() (bsc#1185690).
• CVE-2020-36328: Fixed heap-based buffer overflow in WebPDecode*Into functions (bsc#1185688).
• CVE-2018-25013: Fixed heap-based buffer overflow in ShiftBytes() (bsc#1185654).
• CVE-2020-36331: Fixed heap-based buffer overflow in ChunkAssignData() (bsc#1185686).
• CVE-2018-25009: Fixed heap-based buffer overflow in GetLE16() (bsc#1185673).
• CVE-2018-25011: Fixed fail on multiple image chunks (bsc#1186247).

This update for libwebp fixes the following issues:

• CVE-2018-25010: Fixed heap-based buffer overflow in ApplyFilter() (bsc#1185685).
• CVE-2020-36330: Fixed heap-based buffer overflow in ChunkVerifyAndAssign() (bsc#1185691).
• CVE-2020-36332: Fixed extreme memory allocation when reading a file (bsc#1185674).
• CVE-2020-36329: Fixed use-after-free in EmitFancyRGB() (bsc#1185652).
• CVE-2018-25012: Fixed heap-based buffer overflow in GetLE24() (bsc#1185690).
• CVE-2018-25013: Fixed heap-based buffer overflow in ShiftBytes() (bsc#1185654).
• CVE-2020-36331: Fixed heap-based buffer overflow in ChunkAssignData() (bsc#1185686).
• CVE-2018-25009: Fixed heap-based buffer overflow in GetLE16() (bsc#1185673).
• CVE-2018-25011: Fixed fail on multiple image chunks (bsc#1186247).

This update for libwebp fixes the following issues:

• CVE-2018-25010: Fixed heap-based buffer overflow in ApplyFilter() (bsc#1185685).
• CVE-2020-36330: Fixed heap-based buffer overflow in ChunkVerifyAndAssign() (bsc#1185691).
• CVE-2020-36332: Fixed extreme memory allocation when reading a file (bsc#1185674).
• CVE-2020-36329: Fixed use-after-free in EmitFancyRGB() (bsc#1185652).
• CVE-2018-25012: Fixed heap-based buffer overflow in GetLE24() (bsc#1185690).
• CVE-2020-36328: Fixed heap-based buffer overflow in WebPDecode*Into functions (bsc#1185688).
• CVE-2018-25013: Fixed heap-based buffer overflow in ShiftBytes() (bsc#1185654).
• CVE-2020-36331: Fixed heap-based buffer overflow in ChunkAssignData() (bsc#1185686).
• CVE-2018-25009: Fixed heap-based buffer overflow in GetLE16() (bsc#1185673).
• CVE-2018-25011: Fixed fail on multiple image chunks (bsc#1186247).

It was discovered that libwebp incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image file, a remote attacker could use this issue to cause libwebp to crash, resulting in a denial of service, or possibly execute arbitrary code.

USN-4971-1 fixed several vulnerabilities in libwebp. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that libwebp incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image file, a remote attacker could use this issue to cause libwebp to crash, resulting in a denial of service, or possibly execute arbitrary code.