{"id":"CVE-2018-25010","aliases":["ALSA-2021:4231","CLSA-2023-1696537325","CLSA-2026-1777973188","CLSA-2026-1777974224","DEBIAN-CVE-2018-25010","DLA-2677-1","DSA-4930-1","EUVD-2018-13791","GHSA-g4fc-9486-f3m2","RHSA-2021:4231","RLSA-2021:4231","SUSE-SU-2021:1830-1","SUSE-SU-2021:1860-1","UBUNTU-CVE-2018-25010","USN-4971-1","USN-4971-2","openSUSE-SU-2021:1860-1"],"status":"published","title":"A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function...","description":"A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02235,"percentile":0.82896,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2018-12-31T00:00:00Z","modified":"2026-10-29T11:01:09Z","fixes":[{"ecosystem":"Debian:12","package":"libwebp","fixed_in":["0.6.1-2.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libwebp","fixed_in":["0.6.1-2.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libwebp","fixed_in":["0.6.1-2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libwebp","fixed_in":["0.4.0-4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libwebp","fixed_in":["0.4.4-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libwebp","fixed_in":["0.6.1-2ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libwebp","fixed_in":["0.6.1-2ubuntu0.20.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-5.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-5.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libwebp-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libwebp5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libwebpdemux1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libwebpmux1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"webp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-3.el6.tuxcare.els4"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-3.el6.tuxcare.els4"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libwebp-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-3.el6.tuxcare.els4"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libwebp-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-3.el6.tuxcare.els4"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-3.el6.tuxcare.els4"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-3.el6.tuxcare.els4"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libwebp-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-3.el6.tuxcare.els4"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libwebp-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-3.el6.tuxcare.els4"}]}],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2.1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-1+deb9u1"}]}],"versions":["0.5.2-1"],"bundled":10},{"source":"osv","ecosystem":"Debian:10","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2+deb10u1"}]}],"versions":["0.6.1-2"],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp-java-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.7.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.7.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.7.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.7.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.7.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.7.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.7.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.7.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.7.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.7.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.7.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.7.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.7.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.7.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.7.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP2","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-4ubuntu0.1~esm1"}]}],"versions":["0.3.0-3","0.4.0-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1ubuntu0.1~esm1"}]}],"versions":["0.4.3-1.3","0.4.3-1.3build1","0.4.4-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2ubuntu0.18.04.1"}]}],"versions":["0.6.0-3","0.6.0-4","0.6.1-1","0.6.1-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2ubuntu0.20.04.1"}]}],"versions":["0.6.1-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2ubuntu0.18.04.1"}]}],"versions":["0.6.0-3","0.6.0-4","0.6.1-1","0.6.1-2"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2ubuntu0.20.04.1"}]}],"versions":["0.6.1-2"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-4ubuntu0.1~esm1"}]}],"versions":["0.3.0-3","0.4.0-4"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1ubuntu0.1~esm1"}]}],"versions":["0.4.3-1.3","0.4.3-1.3build1","0.4.4-1"],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-3.5.1"}]}],"bundled":10}],"products":[{"vendor":"google","product":"libwebp"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"webmproject","product":"libwebp"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956918","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9105","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://chromium.googlesource.com/webm/libwebp/+/1344a2e947c749d231141a295327e5b99b444d63","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-25010","tags":["advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00005.html"},{"url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00006.html"},{"url":"https://security.netapp.com/advisory/ntap-20211112-0001/"},{"url":"https://support.apple.com/kb/HT212601"},{"url":"https://www.debian.org/security/2021/dsa-4930"},{"url":"http://seclists.org/fulldisclosure/2021/Jul/54"},{"url":"https://github.com/advisories/GHSA-g4fc-9486-f3m2"},{"url":"https://errata.almalinux.org/8/ALSA-2021-4231.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2018-25009","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2018-25010","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2018-25012","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2018-25013","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2018-25014","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-36330","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-36331","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-36332","tags":["report"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04-els/CLSA-2023-1696537325","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1777973188.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1777974224.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-25010","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4231","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956853","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956868","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956917","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956922","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956926","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956927","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4231.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-25009","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-25009","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-25009","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-25010","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-25010","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-25012","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-25012","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-25012","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-25013","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-25013","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-25013","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-25014","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-25014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-25014","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-36330","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-36330","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36330","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-36331","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-36331","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36331","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-36332","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-36332","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36332","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4231","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211830-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185652","tags":["report"]},{"url":"https://bugzilla.suse.com/1185654","tags":["report"]},{"url":"https://bugzilla.suse.com/1185673","tags":["report"]},{"url":"https://bugzilla.suse.com/1185674","tags":["report"]},{"url":"https://bugzilla.suse.com/1185685","tags":["report"]},{"url":"https://bugzilla.suse.com/1185686","tags":["report"]},{"url":"https://bugzilla.suse.com/1185690","tags":["report"]},{"url":"https://bugzilla.suse.com/1185691","tags":["report"]},{"url":"https://bugzilla.suse.com/1186247","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-25009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-25010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-25011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-25012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-25013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36332","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211860-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185688","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36328","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-25010","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4971-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4971-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-25009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-25011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-25012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-25013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-25014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-36328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-36329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-36330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-36331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-36332","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4ZIJ3ZK5FGNGJN6E65XZKMQPSQ3RKNVG/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-25010","description":"A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().","status":"published","published":"2021-05-21T16:24:23Z","modified":"2024-08-05T12:26:39.513Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:35:01.952568Z"}],"euvd":[{"id":"EUVD-2018-13791","description":"A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().","status":"published","published":"2021-05-21T16:24:23Z","modified":"2024-08-05T12:26:39Z","updated_at":"2026-11-03T02:39:27.400094Z"}],"ghsa":[{"id":"GHSA-g4fc-9486-f3m2","title":"A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function...","description":"A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ApplyFilter. The highest threat from this vulnerability is to data confidentiality and to the service availability.","status":"published","published":"2022-05-24T19:02:56Z","modified":"2023-01-27T05:03:39Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:42:17.140708Z"}],"nvd":[{"id":"CVE-2018-25010","description":"A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().","status":"published","published":"2021-05-21T17:15:08.05Z","modified":"2026-06-17T01:54:31.1Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:00.565712Z"}],"osv":[{"id":"CVE-2018-25010","description":"A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().","status":"published","published":"2021-05-21T17:15:08.05Z","modified":"2026-10-24T10:30:53.742402804Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"DEBIAN-CVE-2018-25010","description":"A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().","status":"published","published":"2021-05-21T17:15:08.05Z","modified":"2026-10-23T18:03:21.098014487Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"RHSA-2021:4231","title":"Red Hat Security Advisory: libwebp security update","status":"published","published":"2024-09-16T05:59:17Z","modified":"2026-04-30T10:33:36.215306Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4231","title":"Moderate: libwebp security update","description":"The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.\n\nSecurity Fix(es):\n\n* libwebp: out-of-bounds read in WebPMuxCreateInternal (CVE-2018-25009)\n\n* libwebp: out-of-bounds read in ApplyFilter() (CVE-2018-25010)\n\n* libwebp: out-of-bounds read in WebPMuxCreateInternal() (CVE-2018-25012)\n\n* libwebp: out-of-bounds read in ShiftBytes() (CVE-2018-25013)\n\n* libwebp: use of uninitialized value in ReadSymbol() (CVE-2018-25014)\n\n* libwebp: out-of-bounds read in ChunkVerifyAndAssign() in mux/muxread.c (CVE-2020-36330)\n\n* libwebp: out-of-bounds read in ChunkAssignData() in mux/muxinternal.c (CVE-2020-36331)\n\n* libwebp: excessive memory allocation when reading a file (CVE-2020-36332)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:47:24Z","modified":"2026-02-05T04:15:13.860031Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2018-25010","description":"A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().","status":"published","published":"2018-12-31T00:00:00Z","modified":"2026-04-22T11:52:56.646847Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"ALSA-2021:4231","title":"Moderate: libwebp security update","description":"The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.\n\nSecurity Fix(es):\n\n* libwebp: out-of-bounds read in WebPMuxCreateInternal (CVE-2018-25009)\n\n* libwebp: out-of-bounds read in ApplyFilter() (CVE-2018-25010)\n\n* libwebp: out-of-bounds read in WebPMuxCreateInternal() (CVE-2018-25012)\n\n* libwebp: out-of-bounds read in ShiftBytes() (CVE-2018-25013)\n\n* libwebp: use of uninitialized value in ReadSymbol() (CVE-2018-25014)\n\n* libwebp: out-of-bounds read in ChunkVerifyAndAssign() in mux/muxread.c (CVE-2020-36330)\n\n* libwebp: out-of-bounds read in ChunkAssignData() in mux/muxinternal.c (CVE-2020-36331)\n\n* libwebp: excessive memory allocation when reading a file (CVE-2020-36332)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:47:24Z","modified":"2026-10-29T11:01:09.405173313Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2023-1696537325","title":"Fix of 10 CVEs","description":"\n   * SECURITY UPDATE: a heap-based buffer overflow\n     - debian/patches/CVE-2018-25009.patch: add additional check to avoid\n       read over the header\n     - CVE-2018-25009\n   * SECURITY UPDATE: a heap-based buffer overflow\n     - debian/patches/CVE-2018-25010.patch: limit the filter size to not\n       exceed the image dimensions\n     - CVE-2018-25010\n   * SECURITY UPDATE: fail on multiple image chunks\n     - debian/patches/CVE-2018-25011.patch: only 1 image chunk allowed\n     - CVE-2018-25011\n   * SECURITY UPDATE: a heap-based buffer overflow\n     - debian/patches/CVE-2018-25013_4.patch: wait for all threads to\n       be done in DecodeRemaining.\n     - CVE-2018-25013\n     - CVE-2018-25014\n   * SECURITY UPDATE: a heap-based buffer overflow\n     - debian/patches/CVE-2020-36328.patch: fix invalid check for buffer\n       size\n     - CVE-2020-36328\n   * SECURITY UPDATE: a use-after-free was found due to a thread being\n     killed too early\n     - debian/patches/CVE-2020-36329.patch: fix for thread race\n       heap-use-after-free\n     - CVE-2020-36329\n   * SECURITY UPDATE: an out-of-bounds read\n     - debian/patches/CVE-2020-36330.patch: fix riff size checks\n     - CVE-2020-36330\n   * SECURITY UPDATE: an out-of-bounds read\n     - debian/patches/CVE-2020-36331.patch: validate chunk_size\n     - CVE-2020-36331\n   * SECURITY UPDATE: a use after free/double free\n     - debian/patches/CVE-2023-1999.patch: clear result-\u003ebw on error\n     - CVE-2023-1999","status":"published","published":"2023-10-05T20:22:09Z","modified":"2026-06-04T10:03:22.957732Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2026-1777973188","title":"libwebp: Fix of 6 CVEs","description":"- CVE-2018-25009: fix out-of-bounds read in GetLE16() by validating VP8X\n  chunk size\n- CVE-2018-25010: fix heap-based buffer overflow in ApplyFilter() by\n  limiting filter radius to image dimensions\n- CVE-2018-25011: fix heap-based buffer overflow in PutLE16() by\n  rejecting multiple image chunks in ANMF frames\n- CVE-2018-25012: fix out-of-bounds read in GetLE24() by validating VP8X\n  chunk size\n- CVE-2018-25013: fix heap-based buffer overflow in ShiftBytes() by\n  synchronizing threads in DecodeRemaining\n- CVE-2018-25014: fix use of uninitialized value in ReadSymbol() by\n  validating decoder readiness and synchronizing threads","status":"published","published":"2026-05-05T09:26:34Z","modified":"2026-06-01T00:33:26.061060474Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1777974224","title":"libwebp: Fix of 6 CVEs","description":"- CVE-2018-25009: fix out-of-bounds read in GetLE16() by validating VP8X\n  chunk size\n- CVE-2018-25010: fix heap-based buffer overflow in ApplyFilter() by\n  limiting filter radius to image dimensions\n- CVE-2018-25011: fix heap-based buffer overflow in PutLE16() by\n  rejecting multiple image chunks in ANMF frames\n- CVE-2018-25012: fix out-of-bounds read in GetLE24() by validating VP8X\n  chunk size\n- CVE-2018-25013: fix heap-based buffer overflow in ShiftBytes() by\n  synchronizing threads in DecodeRemaining\n- CVE-2018-25014: fix use of uninitialized value in ReadSymbol() by\n  validating decoder readiness and synchronizing threads","status":"published","published":"2026-05-05T23:41:05Z","modified":"2026-06-01T00:32:44.309141197Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-2677-1","title":"libwebp - security update","status":"published","published":"2021-06-05T00:00:00Z","modified":"2026-03-09T01:20:09.905035Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4930-1","title":"libwebp - security update","status":"published","published":"2021-06-10T00:00:00Z","modified":"2026-03-09T02:09:42.528795Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2021:1860-1","title":"Security update for libwebp","description":"This update for libwebp fixes the following issues:\n\n- CVE-2018-25010: Fixed heap-based buffer overflow in ApplyFilter() (bsc#1185685).\n- CVE-2020-36330: Fixed heap-based buffer overflow in ChunkVerifyAndAssign() (bsc#1185691).\n- CVE-2020-36332: Fixed extreme memory allocation when reading a file (bsc#1185674).\n- CVE-2020-36329: Fixed use-after-free in EmitFancyRGB() (bsc#1185652).\n- CVE-2018-25012: Fixed heap-based buffer overflow in GetLE24() (bsc#1185690).\n- CVE-2020-36328: Fixed heap-based buffer overflow in WebPDecode*Into functions (bsc#1185688).\n- CVE-2018-25013: Fixed heap-based buffer overflow in ShiftBytes() (bsc#1185654).\n- CVE-2020-36331: Fixed heap-based buffer overflow in ChunkAssignData() (bsc#1185686).\n- CVE-2018-25009: Fixed heap-based buffer overflow in GetLE16() (bsc#1185673).\n- CVE-2018-25011: Fixed fail on multiple image chunks (bsc#1186247).\n","status":"published","published":"2021-07-10T18:55:42Z","modified":"2026-02-04T03:04:29.780596Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"SUSE-SU-2021:1830-1","title":"Security update for libwebp","description":"This update for libwebp fixes the following issues:\n\n- CVE-2018-25010: Fixed heap-based buffer overflow in ApplyFilter() (bsc#1185685).\n- CVE-2020-36330: Fixed heap-based buffer overflow in ChunkVerifyAndAssign() (bsc#1185691).\n- CVE-2020-36332: Fixed extreme memory allocation when reading a file (bsc#1185674).\n- CVE-2020-36329: Fixed use-after-free in EmitFancyRGB() (bsc#1185652).\n- CVE-2018-25012: Fixed heap-based buffer overflow in GetLE24() (bsc#1185690).\n- CVE-2018-25013: Fixed heap-based buffer overflow in ShiftBytes() (bsc#1185654).\n- CVE-2020-36331: Fixed heap-based buffer overflow in ChunkAssignData() (bsc#1185686).\n- CVE-2018-25009: Fixed heap-based buffer overflow in GetLE16() (bsc#1185673).\n- CVE-2018-25011: Fixed fail on multiple image chunks (bsc#1186247).\n","status":"published","published":"2021-06-02T12:23:27Z","modified":"2026-02-04T04:30:38.118989Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1860-1","title":"Security update for libwebp","description":"This update for libwebp fixes the following issues:\n\n- CVE-2018-25010: Fixed heap-based buffer overflow in ApplyFilter() (bsc#1185685).\n- CVE-2020-36330: Fixed heap-based buffer overflow in ChunkVerifyAndAssign() (bsc#1185691).\n- CVE-2020-36332: Fixed extreme memory allocation when reading a file (bsc#1185674).\n- CVE-2020-36329: Fixed use-after-free in EmitFancyRGB() (bsc#1185652).\n- CVE-2018-25012: Fixed heap-based buffer overflow in GetLE24() (bsc#1185690).\n- CVE-2020-36328: Fixed heap-based buffer overflow in WebPDecode*Into functions (bsc#1185688).\n- CVE-2018-25013: Fixed heap-based buffer overflow in ShiftBytes() (bsc#1185654).\n- CVE-2020-36331: Fixed heap-based buffer overflow in ChunkAssignData() (bsc#1185686).\n- CVE-2018-25009: Fixed heap-based buffer overflow in GetLE16() (bsc#1185673).\n- CVE-2018-25011: Fixed fail on multiple image chunks (bsc#1186247).\n","status":"published","published":"2021-06-04T07:04:48Z","modified":"2026-02-04T03:09:44.729813Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4971-1","title":"libwebp vulnerabilities","description":"It was discovered that libwebp incorrectly handled certain malformed\nimages. If a user or automated system were tricked into opening a specially\ncrafted image file, a remote attacker could use this issue to cause libwebp\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n","status":"published","published":"2021-06-01T11:29:35Z","modified":"2026-04-27T16:03:37.683699506Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-4971-2","title":"libwebp vulnerabilities","description":"USN-4971-1 fixed several vulnerabilities in libwebp. This update provides\nthe corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that libwebp incorrectly handled certain malformed\n images. If a user or automated system were tricked into opening a specially\n crafted image file, a remote attacker could use this issue to cause libwebp\n to crash, resulting in a denial of service, or possibly execute arbitrary\n code.\n","status":"published","published":"2021-06-10T13:12:37Z","modified":"2026-06-29T13:49:12.454575161Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}