{"id":"CVE-2023-1999","aliases":["ALPINE-CVE-2023-1999","ALSA-2023:2076","ALSA-2023:2078","AZL-27181","BELL-CVE-2023-1999","CLSA-2023-1696537325","CLSA-2023-1696970233","CLSA-2023-1696970439","CLSA-2023-1697135462","CLSA-2023-1697136085","DEBIAN-CVE-2023-1999","DLA-3391-1","DLA-3400-1","DLA-3439-1","DSA-5385-1","DSA-5392-1","DSA-5408-1","EUVD-2023-24179","GHSA-8x9p-cw2c-6253","JLSEC-2026-440","OESA-2023-1317","OESA-2023-1684","OESA-2023-1685","OESA-2026-3213","OESA-2026-3214","OESA-2026-3215","RHSA-2023:1785","RHSA-2023:1786","RHSA-2023:1787","RHSA-2023:1788","RHSA-2023:1789","RHSA-2023:1790","RHSA-2023:1791","RHSA-2023:1792","RHSA-2023:1802","RHSA-2023:1803","RHSA-2023:1804","RHSA-2023:1805","RHSA-2023:1806","RHSA-2023:1809","RHSA-2023:1810","RHSA-2023:1811","RHSA-2023:2072","RHSA-2023:2073","RHSA-2023:2075","RHSA-2023:2076","RHSA-2023:2077","RHSA-2023:2078","RHSA-2023:2084","RHSA-2023:2085","RLSA-2023:2076","RLSA-2023:2078","SUSE-SU-2023:2064-1","SUSE-SU-2023:2467-1","SUSE-SU-2023:2490-1","SUSE-SU-2023:2552-1","UBUNTU-CVE-2023-1999","USN-6078-1","USN-6078-2","openSUSE-SU-2024:13019-1"],"status":"published","title":"Use after free in libwebp","description":"There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00952,"percentile":0.61557,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-415","CWE-416"],"published":"2023-04-12T00:00:00Z","modified":"2026-11-03T06:32:58Z","exploits":[{"source":"pocgithub","id":"Pazhanivelmani/webp_Android10_r33_CVE-2023-1999","title":"Pazhanivelmani/webp_Android10_r33_CVE-2023-1999","date":"2024-11-12","url":"https://github.com/Pazhanivelmani/webp_Android10_r33_CVE-2023-1999"}],"fixes":[{"ecosystem":"Alpine:v3.18","package":"firefox-esr","fixed_in":["102.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"firefox-esr","fixed_in":["102.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"firefox-esr","fixed_in":["102.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"firefox-esr","fixed_in":["102.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"firefox-esr","fixed_in":["102.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"firefox-esr","fixed_in":["102.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libwebp","fixed_in":["1.2.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libwebp","fixed_in":["1.2.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libwebp","fixed_in":["1.2.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libwebp","fixed_in":["1.3.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libwebp","fixed_in":["1.3.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libwebp","fixed_in":["1.3.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libwebp","fixed_in":["1.3.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libwebp","fixed_in":["1.3.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libwebp","fixed_in":["1.3.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libwebp","fixed_in":["1.3.0-r3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libwebp","fixed_in":["1.0.0-8.el8_7"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libwebp-devel","fixed_in":["1.0.0-8.el8_7"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libwebp","fixed_in":["1.2.0-6.el9_1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libwebp-devel","fixed_in":["1.2.0-6.el9_1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libwebp","fixed_in":["1.3.2-1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"libwebp","fixed_in":["0.4.3-3.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"libwebp-devel","fixed_in":["0.4.3-3.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"libwebp-java","fixed_in":["0.4.3-3.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"libwebp-tools","fixed_in":["0.4.3-3.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"libwebp","fixed_in":["0.4.3-3.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"libwebp-devel","fixed_in":["0.4.3-3.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"libwebp-java","fixed_in":["0.4.3-3.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"libwebp-tools","fixed_in":["0.4.3-3.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"firefox-esr","fixed_in":["102.10.0esr-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"firefox-esr","fixed_in":["102.10.0esr-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"firefox-esr","fixed_in":["102.10.0esr-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libwebp","fixed_in":["1.2.4-0.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libwebp","fixed_in":["1.2.4-0.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libwebp","fixed_in":["1.2.4-0.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:102.10.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:102.10.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thunderbird","fixed_in":["1:102.10.0-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"libwebp","fixed_in":["0.6.1-2+deb10u2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"libwebp","fixed_in":["0.6.1-2.1+deb11u1"],"sources":["osv"]},{"ecosystem":"Julia","package":"libwebp_jll","fixed_in":["1.3.2+0"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"libwebp","fixed_in":["1.1.0-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"libwebp","fixed_in":["1.1.0-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"libwebp","fixed_in":["1.2.1-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"libwebp","fixed_in":["1.2.1-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"firefox","fixed_in":["102.14.0-1.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"firefox","fixed_in":["102.14.0-1.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"libwebp","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"libwebp-debuginfo","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"libwebp-debugsource","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"libwebp-devel","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"libwebp-java-debuginfo","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"libwebp-tools-debuginfo","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"libwebp","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"libwebp-debuginfo","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"libwebp-debugsource","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"libwebp-devel","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"libwebp-java-debuginfo","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"libwebp-tools-debuginfo","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"libwebp","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"libwebp-debuginfo","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"libwebp-debugsource","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"libwebp-devel","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"libwebp-java-debuginfo","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"libwebp-tools-debuginfo","fixed_in":["0:1.0.0-7.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"libwebp","fixed_in":["0:1.0.0-5.2.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"libwebp-debuginfo","fixed_in":["0:1.0.0-5.2.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"libwebp-debugsource","fixed_in":["0:1.0.0-5.2.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"libwebp-devel","fixed_in":["0:1.0.0-5.2.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"libwebp-java-debuginfo","fixed_in":["0:1.0.0-5.2.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"libwebp-tools-debuginfo","fixed_in":["0:1.0.0-5.2.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"libwebp","fixed_in":["0:1.2.0-5.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"libwebp-debuginfo","fixed_in":["0:1.2.0-5.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"libwebp-debugsource","fixed_in":["0:1.2.0-5.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"libwebp-devel","fixed_in":["0:1.2.0-5.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"libwebp-java-debuginfo","fixed_in":["0:1.2.0-5.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"libwebp-tools-debuginfo","fixed_in":["0:1.2.0-5.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp","fixed_in":["0:1.0.0-8.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp-debuginfo","fixed_in":["0:1.0.0-8.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp-debugsource","fixed_in":["0:1.0.0-8.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp-devel","fixed_in":["0:1.0.0-8.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp-java-debuginfo","fixed_in":["0:1.0.0-8.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp-tools-debuginfo","fixed_in":["0:1.0.0-8.el8_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwebp","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwebp-debuginfo","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwebp-devel","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwebp-java","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwebp-tools","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libwebp-debuginfo","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libwebp-devel","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libwebp-java","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libwebp-tools","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwebp","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwebp-debuginfo","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwebp-devel","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwebp-java","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwebp-tools","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwebp","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwebp-debuginfo","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwebp-devel","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwebp-java","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwebp-tools","fixed_in":["0:0.3.0-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwebp","fixed_in":["0:1.2.0-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwebp-debuginfo","fixed_in":["0:1.2.0-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwebp-debugsource","fixed_in":["0:1.2.0-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwebp-devel","fixed_in":["0:1.2.0-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwebp-java-debuginfo","fixed_in":["0:1.2.0-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwebp-tools-debuginfo","fixed_in":["0:1.2.0-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libwebp","fixed_in":["0:1.0.0-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libwebp-debuginfo","fixed_in":["0:1.0.0-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libwebp-debugsource","fixed_in":["0:1.0.0-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libwebp-devel","fixed_in":["0:1.0.0-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libwebp-java-debuginfo","fixed_in":["0:1.0.0-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libwebp-tools-debuginfo","fixed_in":["0:1.0.0-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"libwebp","fixed_in":["0:1.0.0-7.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"libwebp-debuginfo","fixed_in":["0:1.0.0-7.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"libwebp-debugsource","fixed_in":["0:1.0.0-7.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"libwebp-devel","fixed_in":["0:1.0.0-7.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"libwebp-java-debuginfo","fixed_in":["0:1.0.0-7.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"libwebp-tools-debuginfo","fixed_in":["0:1.0.0-7.el8_6"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"libwebp","fixed_in":["0:1.0.0-8.el8_7"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"libwebp","fixed_in":["0:1.2.0-6.el9_1","0:1.2.0-6.el9_1.0.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"libwebp","fixed_in":["1.0.3-150200.3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"libwebp","fixed_in":["1.0.3-150200.3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"libwebp","fixed_in":["1.0.3-150200.3.5.1","0.5.0-150000.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"libwebp","fixed_in":["1.0.3-150200.3.5.1","0.5.0-150000.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"libwebp","fixed_in":["1.0.3-150200.3.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"libwebp","fixed_in":["1.0.3-150200.3.5.1","0.5.0-150000.3.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"libwebp","fixed_in":["1.0.3-150200.3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"libwebp","fixed_in":["0.5.0-150000.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"libwebp","fixed_in":["0.5.0-150000.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"libwebp","fixed_in":["0.4.3-4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"libwebp","fixed_in":["0.4.3-4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"libwebp","fixed_in":["0.4.3-4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"libwebp","fixed_in":["0.4.3-4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"libwebp","fixed_in":["0.4.3-4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libwebp","fixed_in":["0.4.3-4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libwebp","fixed_in":["0.4.3-4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libwebp","fixed_in":["0.4.3-4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"libwebp","fixed_in":["0.4.3-4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"libwebp","fixed_in":["0.4.3-4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libwebp","fixed_in":["0.4.3-4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libwebp","fixed_in":["0.4.3-4.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libwebp","fixed_in":["0.4.4-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libwebp","fixed_in":["0.6.1-2ubuntu0.18.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libwebp","fixed_in":["0.6.1-2ubuntu0.20.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libwebp","fixed_in":["1.2.2-2ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libwebp","fixed_in":["1.3.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.2"},{"fixed":"1.2.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.2"},{"fixed":"1.2.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.2"},{"fixed":"1.2.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.2"},{"fixed":"1.3.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.2"},{"fixed":"1.3.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.2"},{"fixed":"1.3.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.2"},{"fixed":"1.3.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.2"},{"fixed":"1.3.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.2"},{"fixed":"1.3.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.2"},{"fixed":"1.3.0-r3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-8.el8_7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-8.el8_7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-6.el9_1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-6.el9_1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libwebp-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libwebp5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libwebpdemux1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libwebpmux1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"webp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-5.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-5.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libwebp-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-5.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libwebp-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-5.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-5.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-5.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libwebp-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-5.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libwebp-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-5.el8.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-3.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-3.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libwebp-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-3.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libwebp-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-3.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-3.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-3.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libwebp-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-3.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libwebp-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-3.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.10.0esr-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.10.0esr-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.10.0esr-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-0.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-0.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-0.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.10.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.10.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.10.0-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.10.0esr-1~deb10u1"}]}],"versions":["102.1.0esr-1","102.1.0esr-2","102.2.0esr-1","102.3.0esr-1","102.3.0esr-1~deb10u1","102.3.0esr-1~deb10u2","102.3.0esr-1~deb11u1","102.4.0esr-1","102.4.0esr-1~deb10u1","102.4.0esr-1~deb11u1","102.5.0esr-1","102.5.0esr-1~deb10u1","102.5.0esr-1~deb11u1","102.6.0esr-1","102.6.0esr-1~deb10u1","102.6.0esr-1~deb11u1","102.7.0esr-1","102.7.0esr-1~deb10u1","102.7.0esr-1~deb11u1","102.8.0esr-1","102.8.0esr-1~deb10u1","102.8.0esr-1~deb11u1","102.9.0esr-1","102.9.0esr-1~deb10u1","102.9.0esr-1~deb11u1","102.9.0esr-2","60.7.2esr-1","60.8.0esr-1","60.8.0esr-1~deb10u1","60.8.0esr-1~deb8u1","60.8.0esr-1~deb9u1","60.9.0esr-1~deb10u1","60.9.0esr-1~deb8u1","60.9.0esr-1~deb8u2","60.9.0esr-1~deb9u1","68.0.2esr-1","68.1.0esr-1","68.10.0esr-1","68.10.0esr-1~deb10u1","68.10.0esr-1~deb9u1","68.11.0esr-1","68.11.0esr-1~deb10u1","68.11.0esr-1~deb9u1","68.12.0esr-1","68.12.0esr-1~deb10u1","68.12.0esr-1~deb9u1","68.2.0esr-1","68.2.0esr-1~deb10u1","68.2.0esr-1~deb8u1","68.2.0esr-1~deb9u1","68.2.0esr-1~deb9u2","68.3.0esr-1","68.3.0esr-1~deb10u1","68.3.0esr-1~deb8u1","68.3.0esr-1~deb9u1","68.4.0esr-1","68.4.0esr-1~deb10u1","68.4.0esr-1~deb8u1","68.4.0esr-1~deb9u1","68.4.1esr-1","68.4.1esr-1~deb10u1","68.4.1esr-1~deb8u1","68.4.1esr-1~deb9u1","68.4.2esr-1","68.5.0esr-1","68.5.0esr-1~deb10u1","68.5.0esr-1~deb8u1","68.5.0esr-1~deb9u1","68.6.0esr-1","68.6.0esr-1~deb10u1","68.6.0esr-1~deb8u1","68.6.0esr-1~deb9u1","68.6.1esr-1","68.6.1esr-1~deb10u1","68.6.1esr-1~deb9u1","68.7.0esr-1","68.7.0esr-1~deb10u1","68.7.0esr-1~deb8u1","68.7.0esr-1~deb9u1","68.8.0esr-1","68.8.0esr-1~deb10u1","68.8.0esr-1~deb8u1","68.8.0esr-1~deb9u1","68.9.0esr-1","68.9.0esr-1~deb10u1","68.9.0esr-1~deb8u1","68.9.0esr-1~deb8u2","68.9.0esr-1~deb9u1","78.10.0esr-1","78.10.0esr-1~deb10u1","78.10.0esr-1~deb9u1","78.11.0esr-1","78.11.0esr-1~deb10u1","78.11.0esr-1~deb9u1","78.12.0esr-1","78.12.0esr-1~deb10u1","78.12.0esr-1~deb9u1","78.13.0esr-1","78.13.0esr-1~deb10u1","78.13.0esr-1~deb11u1","78.13.0esr-1~deb9u1","78.14.0esr-1","78.14.0esr-1~deb10u1","78.14.0esr-1~deb11u1","78.14.0esr-1~deb9u1","78.15.0esr-1~deb10u1","78.15.0esr-1~deb11u1","78.15.0esr-1~deb9u1","78.2.0esr-1","78.3.0esr-1","78.3.0esr-1~deb10u1","78.3.0esr-1~deb9u1","78.3.0esr-1~deb9u2","78.3.0esr-2","78.4.0esr-1","78.4.0esr-1~deb10u1","78.4.0esr-1~deb10u2","78.4.0esr-1~deb9u1","78.4.0esr-2","78.4.1esr-1","78.4.1esr-1~deb10u1","78.4.1esr-1~deb9u1","78.4.1esr-2","78.5.0esr-1","78.5.0esr-1~deb10u1","78.5.0esr-1~deb9u1","78.6.0esr-1","78.6.0esr-1~deb10u1","78.6.0esr-1~deb9u1","78.6.1esr-1","78.6.1esr-1~deb10u1","78.6.1esr-1~deb9u1","78.7.0esr-1","78.7.0esr-1~deb10u1","78.7.0esr-1~deb9u1","78.8.0esr-1","78.8.0esr-1~deb10u1","78.8.0esr-1~deb9u1","78.9.0esr-1","78.9.0esr-1~deb10u1","78.9.0esr-1~deb9u1","91.0.1esr-1","91.0esr-1","91.1.0esr-1","91.10.0esr-1","91.10.0esr-1~deb10u1","91.10.0esr-1~deb11u1","91.10.0esr-1~deb9u1","91.11.0esr-1","91.11.0esr-1~deb10u1","91.11.0esr-1~deb11u1","91.11.0esr-1~deb9u1","91.12.0esr-1","91.12.0esr-1~deb10u1","91.12.0esr-1~deb11u1","91.13.0esr-1~deb10u1","91.13.0esr-1~deb11u1","91.2.0esr-1","91.3.0esr-1","91.3.0esr-2","91.4.0esr-1","91.4.1esr-1~deb11u1","91.4.1esr-1~deb9u1","91.5.0esr-1","91.5.0esr-1~deb10u1","91.5.0esr-1~deb11u1","91.5.0esr-1~deb9u1","91.5.1esr-1","91.6.0esr-1","91.6.0esr-1~deb10u1","91.6.0esr-1~deb11u1","91.6.0esr-1~deb9u1","91.6.1esr-1","91.6.1esr-1~deb10u1","91.6.1esr-1~deb11u1","91.6.1esr-1~deb9u1","91.7.0esr-1","91.7.0esr-1~deb10u1","91.7.0esr-1~deb11u1","91.7.0esr-1~deb9u1","91.8.0esr-1","91.8.0esr-1~deb10u1","91.8.0esr-1~deb11u1","91.8.0esr-1~deb9u1","91.9.0esr-1","91.9.0esr-1~deb10u1","91.9.0esr-1~deb11u1","91.9.0esr-1~deb9u1","91.9.1esr-1","91.9.1esr-1~deb10u1","91.9.1esr-1~deb11u1","91.9.1esr-1~deb9u1"],"bundled":9},{"source":"osv","ecosystem":"Debian:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.10.0-1~deb10u1"}]}],"versions":["1:102.0.1-1","1:102.0.2-1","1:102.0~b4-1","1:102.0~b7-1","1:102.1.0-1","1:102.1.1-1","1:102.1.2-1","1:102.2.0-1","1:102.2.1-1","1:102.2.2-1","1:102.3.0-1","1:102.3.0-1~deb10u1","1:102.3.0-1~deb11u1","1:102.3.1-1","1:102.3.2-1","1:102.3.3-1","1:102.4.0-1","1:102.4.0-1~deb10u1","1:102.4.0-1~deb11u1","1:102.4.1-1","1:102.5.0-1","1:102.5.0-1~deb10u1","1:102.5.0-1~deb11u1","1:102.5.1-1","1:102.6.0-1","1:102.6.0-1~deb10u1","1:102.6.0-1~deb11u1","1:102.7.1+1-1","1:102.7.1-1","1:102.7.2-1","1:102.8.0-1","1:102.8.0-1~deb10u1","1:102.8.0-1~deb11u1","1:102.9.0-1","1:102.9.0-1~deb10u1","1:102.9.0-1~deb11u1","1:102.9.1-1","1:60.7.2-1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.10.0-1","1:68.10.0-1~deb10u1","1:68.10.0-1~deb9u1","1:68.11.0-1","1:68.11.0-1~deb10u1","1:68.11.0-1~deb9u1","1:68.11.0-2","1:68.11.0-3","1:68.12.0-1","1:68.12.0-1~deb10u1","1:68.12.0-1~deb9u1","1:68.12.0-1~deb9u2","1:68.2.1-1","1:68.2.2-1","1:68.2.2-1~deb10u1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1","1:68.3.0-1","1:68.3.0-2","1:68.3.0-2~deb10u1","1:68.3.0-2~deb8u1","1:68.3.0-2~deb9u1","1:68.3.1-1","1:68.4.1-1","1:68.4.1-1~deb10u1","1:68.4.1-1~deb8u1","1:68.4.1-1~deb9u1","1:68.4.2-1","1:68.5.0-1","1:68.5.0-1~deb10u1","1:68.5.0-1~deb8u1","1:68.5.0-1~deb9u1","1:68.6.0-1","1:68.6.0-1~deb10u1","1:68.6.0-1~deb8u1","1:68.6.0-1~deb9u1","1:68.7.0-1","1:68.7.0-1~deb10u1","1:68.7.0-1~deb8u1","1:68.7.0-1~deb9u1","1:68.8.0-1","1:68.8.0-1~deb10u1","1:68.8.0-1~deb8u1","1:68.8.0-1~deb9u1","1:68.8.1-1","1:68.9.0-1","1:68.9.0-1~deb10u1","1:68.9.0-1~deb8u1","1:68.9.0-1~deb8u2","1:68.9.0-1~deb9u1","1:76.0~b1-1","1:76.0~b2-1","1:77.0~b1-1","1:77.0~b2-1","1:77.0~b3-1","1:78.0-1","1:78.0.1-1","1:78.0~b1-1","1:78.0~b2-1","1:78.1.0-1","1:78.1.1-1","1:78.10.0-1","1:78.10.0-1~deb10u1","1:78.10.0-1~deb9u1","1:78.10.2-1","1:78.11.0-1","1:78.11.0-1~deb10u1","1:78.11.0-1~deb9u1","1:78.11.0-2","1:78.12.0-1","1:78.12.0-1~deb10u1","1:78.12.0-1~deb9u1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:78.2.0-1","1:78.2.1-1","1:78.2.2-1","1:78.3.1-1","1:78.3.1-2","1:78.3.1-2~deb10u1","1:78.3.1-2~deb10u2","1:78.3.1-2~deb9u1","1:78.3.2-1","1:78.3.3-1","1:78.4.0-1","1:78.4.0-1~deb10u1","1:78.4.0-1~deb9u1","1:78.4.1-1","1:78.4.2-1","1:78.4.2-1~deb10u1","1:78.4.2-1~deb9u1","1:78.5.0-1","1:78.5.0-1~deb10u1","1:78.5.0-1~deb9u1","1:78.5.1-1","1:78.5.1-1~deb10u1","1:78.5.1-1~deb9u1","1:78.6.0-1","1:78.6.0-1~deb10u1","1:78.6.0-1~deb9u1","1:78.6.1-1","1:78.7.0-1","1:78.7.0-1~deb10u1","1:78.7.0-1~deb9u1","1:78.7.1-1","1:78.8.0-1","1:78.8.0-1~deb10u1","1:78.8.0-1~deb9u1","1:78.9.0-1","1:78.9.0-1~deb10u1","1:78.9.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.10.0-1","1:91.10.0-1~deb10u1","1:91.10.0-1~deb11u1","1:91.10.0-1~deb9u1","1:91.11.0-1","1:91.11.0-1~deb10u1","1:91.11.0-1~deb11u1","1:91.12.0-1~deb10u1","1:91.12.0-1~deb11u1","1:91.13.0-1~deb10u1","1:91.13.0-1~deb11u1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1","1:91.4.1-1~deb10u1","1:91.4.1-1~deb11u1","1:91.4.1-1~deb9u1","1:91.5.0-1","1:91.5.0-1~deb9u1","1:91.5.0-2","1:91.5.0-2~deb10u1","1:91.5.0-2~deb11u1","1:91.5.1-1","1:91.6.0-1","1:91.6.0-1~deb10u1","1:91.6.0-1~deb11u1","1:91.6.0-1~deb9u1","1:91.6.1-1","1:91.6.1-1~deb10u1","1:91.6.1-1~deb11u1","1:91.6.1-1~deb9u1","1:91.6.2-1","1:91.6.2-1~deb10u1","1:91.6.2-1~deb11u1","1:91.6.2-1~deb9u1","1:91.7.0-1","1:91.7.0-2","1:91.7.0-2~deb10u1","1:91.7.0-2~deb11u1","1:91.7.0-2~deb9u1","1:91.8.0-1","1:91.8.0-1~deb10u1","1:91.8.0-1~deb11u1","1:91.8.0-1~deb9u1","1:91.8.1-1","1:91.9.0-1","1:91.9.0-1~deb10u1","1:91.9.0-1~deb11u1","1:91.9.0-1~deb9u1"],"bundled":12},{"source":"osv","ecosystem":"Debian:10","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2+deb10u2"}]}],"versions":["0.6.1-2","0.6.1-2+deb10u1"]},{"source":"osv","ecosystem":"Debian:11","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.10.0esr-1~deb11u1"}]}],"versions":["102.1.0esr-1","102.1.0esr-2","102.10.0esr-1~deb10u1","102.2.0esr-1","102.3.0esr-1","102.3.0esr-1~deb10u1","102.3.0esr-1~deb10u2","102.3.0esr-1~deb11u1","102.4.0esr-1","102.4.0esr-1~deb10u1","102.4.0esr-1~deb11u1","102.5.0esr-1","102.5.0esr-1~deb10u1","102.5.0esr-1~deb11u1","102.6.0esr-1","102.6.0esr-1~deb10u1","102.6.0esr-1~deb11u1","102.7.0esr-1","102.7.0esr-1~deb10u1","102.7.0esr-1~deb11u1","102.8.0esr-1","102.8.0esr-1~deb10u1","102.8.0esr-1~deb11u1","102.9.0esr-1","102.9.0esr-1~deb10u1","102.9.0esr-1~deb11u1","102.9.0esr-2","78.12.0esr-1","78.13.0esr-1","78.13.0esr-1~deb10u1","78.13.0esr-1~deb11u1","78.13.0esr-1~deb9u1","78.14.0esr-1","78.14.0esr-1~deb10u1","78.14.0esr-1~deb11u1","78.14.0esr-1~deb9u1","78.15.0esr-1~deb10u1","78.15.0esr-1~deb11u1","78.15.0esr-1~deb9u1","91.0.1esr-1","91.0esr-1","91.1.0esr-1","91.10.0esr-1","91.10.0esr-1~deb10u1","91.10.0esr-1~deb11u1","91.10.0esr-1~deb9u1","91.11.0esr-1","91.11.0esr-1~deb10u1","91.11.0esr-1~deb11u1","91.11.0esr-1~deb9u1","91.12.0esr-1","91.12.0esr-1~deb10u1","91.12.0esr-1~deb11u1","91.13.0esr-1~deb10u1","91.13.0esr-1~deb11u1","91.2.0esr-1","91.3.0esr-1","91.3.0esr-2","91.4.0esr-1","91.4.1esr-1~deb11u1","91.4.1esr-1~deb9u1","91.5.0esr-1","91.5.0esr-1~deb10u1","91.5.0esr-1~deb11u1","91.5.0esr-1~deb9u1","91.5.1esr-1","91.6.0esr-1","91.6.0esr-1~deb10u1","91.6.0esr-1~deb11u1","91.6.0esr-1~deb9u1","91.6.1esr-1","91.6.1esr-1~deb10u1","91.6.1esr-1~deb11u1","91.6.1esr-1~deb9u1","91.7.0esr-1","91.7.0esr-1~deb10u1","91.7.0esr-1~deb11u1","91.7.0esr-1~deb9u1","91.8.0esr-1","91.8.0esr-1~deb10u1","91.8.0esr-1~deb11u1","91.8.0esr-1~deb9u1","91.9.0esr-1","91.9.0esr-1~deb10u1","91.9.0esr-1~deb11u1","91.9.0esr-1~deb9u1","91.9.1esr-1","91.9.1esr-1~deb10u1","91.9.1esr-1~deb11u1","91.9.1esr-1~deb9u1"],"bundled":9},{"source":"osv","ecosystem":"Debian:11","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:102.10.0-1~deb11u1"}]}],"versions":["1:102.0.1-1","1:102.0.2-1","1:102.0~b4-1","1:102.0~b7-1","1:102.1.0-1","1:102.1.1-1","1:102.1.2-1","1:102.10.0-1~deb10u1","1:102.2.0-1","1:102.2.1-1","1:102.2.2-1","1:102.3.0-1","1:102.3.0-1~deb10u1","1:102.3.0-1~deb11u1","1:102.3.1-1","1:102.3.2-1","1:102.3.3-1","1:102.4.0-1","1:102.4.0-1~deb10u1","1:102.4.0-1~deb11u1","1:102.4.1-1","1:102.5.0-1","1:102.5.0-1~deb10u1","1:102.5.0-1~deb11u1","1:102.5.1-1","1:102.6.0-1","1:102.6.0-1~deb10u1","1:102.6.0-1~deb11u1","1:102.7.1+1-1","1:102.7.1-1","1:102.7.2-1","1:102.8.0-1","1:102.8.0-1~deb10u1","1:102.8.0-1~deb11u1","1:102.9.0-1","1:102.9.0-1~deb10u1","1:102.9.0-1~deb11u1","1:102.9.1-1","1:78.12.0-1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.10.0-1","1:91.10.0-1~deb10u1","1:91.10.0-1~deb11u1","1:91.10.0-1~deb9u1","1:91.11.0-1","1:91.11.0-1~deb10u1","1:91.11.0-1~deb11u1","1:91.12.0-1~deb10u1","1:91.12.0-1~deb11u1","1:91.13.0-1~deb10u1","1:91.13.0-1~deb11u1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1","1:91.4.1-1~deb10u1","1:91.4.1-1~deb11u1","1:91.4.1-1~deb9u1","1:91.5.0-1","1:91.5.0-1~deb9u1","1:91.5.0-2","1:91.5.0-2~deb10u1","1:91.5.0-2~deb11u1","1:91.5.1-1","1:91.6.0-1","1:91.6.0-1~deb10u1","1:91.6.0-1~deb11u1","1:91.6.0-1~deb9u1","1:91.6.1-1","1:91.6.1-1~deb10u1","1:91.6.1-1~deb11u1","1:91.6.1-1~deb9u1","1:91.6.2-1","1:91.6.2-1~deb10u1","1:91.6.2-1~deb11u1","1:91.6.2-1~deb9u1","1:91.7.0-1","1:91.7.0-2","1:91.7.0-2~deb10u1","1:91.7.0-2~deb11u1","1:91.7.0-2~deb9u1","1:91.8.0-1","1:91.8.0-1~deb10u1","1:91.8.0-1~deb11u1","1:91.8.0-1~deb9u1","1:91.8.1-1","1:91.9.0-1","1:91.9.0-1~deb10u1","1:91.9.0-1~deb11u1","1:91.9.0-1~deb9u1"],"bundled":12},{"source":"osv","ecosystem":"Debian:11","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2.1+deb11u1"}]}],"versions":["0.6.1-2.1"]},{"source":"osv","ecosystem":"Julia","package":"libwebp_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.2+0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.14.0-1.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.14.0-1.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.15.1-1.oe2403sp1"}]}],"bundled":37},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.15.1-1.oe2403sp3"}]}],"bundled":36},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.15.1-1.oe2403sp4"}]}],"bundled":36},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el9_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el9_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el9_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el9_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el9_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el9_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"firefox-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el9_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el7_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-1.el8_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_2"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_2"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_2"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_2"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_2"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_2"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_2"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_2"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_2"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el9_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el9_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el9_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el9_0"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.10.0-2.el8_6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"libwebp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"libwebp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"libwebp-java-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"libwebp-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"libwebp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"libwebp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"libwebp-java-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"libwebp-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"libwebp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"libwebp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"libwebp-java-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"libwebp-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.2.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"libwebp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.2.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"libwebp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.2.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.2.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"libwebp-java-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.2.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"libwebp-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.2.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-5.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"libwebp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-5.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"libwebp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-5.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-5.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"libwebp-java-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-5.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"libwebp-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-5.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-8.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-8.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-8.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-8.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp-java-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-8.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwebp-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-8.el8_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwebp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwebp-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwebp-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libwebp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libwebp-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libwebp-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwebp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwebp-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwebp-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwebp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwebp-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwebp-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwebp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwebp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwebp-java-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwebp-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libwebp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libwebp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libwebp-java-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libwebp-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"libwebp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"libwebp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"libwebp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"libwebp-java-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"libwebp-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-7.el8_6"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-8.el8_7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-6.el9_1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-6.el9_1.0.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.10.1-150200.8.113.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.10.1-150200.8.113.2"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.10.1-150200.8.113.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-150200.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-150200.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-150200.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-150200.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-150200.3.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-150200.3.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-150200.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150000.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150000.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150000.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150000.3.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150000.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-4.10.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.0-3","0.4.0-4","0.4.0-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1ubuntu0.1~esm2"}]}],"versions":["0.4.3-1.3","0.4.3-1.3build1","0.4.4-1","0.4.4-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2ubuntu0.18.04.2"}]}],"versions":["0.6.0-3","0.6.0-4","0.6.1-1","0.6.1-2","0.6.1-2ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.3.1-0ubuntu3","52.3.1-7fakesync1","52.8.1-0ubuntu0.18.04.1","52.9.1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs38","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["38.8.0~repack1-0ubuntu1","38.8.0~repack1-0ubuntu3","38.8.0~repack1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2ubuntu0.20.04.2"}]}],"versions":["0.6.1-2","0.6.1-2ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs68","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["68.5.0-1~fakesync","68.5.0-2~fakesync","68.6.0-1","68.6.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.9.1-1build1","52.9.1-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-2ubuntu0.22.04.1"}]}],"versions":["0.6.1-2.1","0.6.1-2.1build1","1.2.1-6","1.2.1-7","1.2.2-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["78.13.0-1","78.15.0-2","78.15.0-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["91.5.1-0ubuntu1","91.6.0-1","91.6.0-2","91.7.0-2","91.10.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1","1:128.12.0+build1-0ubuntu0.22.04.1","1:140.7.1+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:115.3.1+build1-0ubuntu1","1:115.4.1+build1-0ubuntu1","1:115.4.3+build1-0ubuntu1","1:115.5.0+build1-0ubuntu1","1:115.5.1+build1-0ubuntu1","1:115.5.2+build2-0ubuntu1","1:115.6.0+build1-0ubuntu1","1:115.6.0+build2-0ubuntu1","1:115.6.1+build1-0ubuntu1","1:115.8.0+build1-0ubuntu1","1:115.8.1+build1+snap2","1:115.8.1+build1+snap3","2:1snap1-0ubuntu1","2:1snap1-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu3","2:1snap1-0ubuntu4","2:1snap1-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2ubuntu0.18.04.2"}]}],"versions":["0.6.0-3","0.6.0-4","0.6.1-1","0.6.1-2","0.6.1-2ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2ubuntu0.20.04.2"}]}],"versions":["0.6.1-2","0.6.1-2ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-2ubuntu0.22.04.1"}]}],"versions":["0.6.1-2.1","0.6.1-2.1build1","1.2.1-6","1.2.1-7","1.2.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1ubuntu0.1~esm2"}]}],"versions":["0.4.3-1.3","0.4.3-1.3build1","0.4.4-1","0.4.4-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libwebp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2.1"}]}]}],"products":[{"vendor":"chromium","product":"libwebp"},{"vendor":"google","product":"libwebp"},{"vendor":"webmproject","product":"libwebp"}],"references":[{"url":"https://chromium.googlesource.com/webm/libwebp","tags":["x_transferred","Product","web"]},{"url":"https://security.gentoo.org/glsa/202309-05","tags":["x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1999","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8x9p-cw2c-6253"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-1999","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2076","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-1999","tags":["report"]},{"url":"https://bugzilla.redhat.com/2186102","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-2076.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2078","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-2078.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-1999","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04-els/CLSA-2023-1696537325","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2023-1696970233.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2023-1696970439.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2023-1697135462.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2023-1697136085.html","tags":["advisory"]},{"url":"https://chromium.googlesource.com/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1999.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-1999","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1317","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1684","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1685","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1945","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29533","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29535","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29541","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29548","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32205","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32206","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32207","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32211","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34414","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34416","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37201","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37202","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37207","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37208","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37211","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4045","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4046","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4048","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4050","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4055","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4056","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4573","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4574","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4575","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4581","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4584","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4863","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3214","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3215","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1785","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186103","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186105","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186106","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186109","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186110","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186111","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1785.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-1945","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1945","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1999","tags":["advisory","report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999","tags":["article","report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999","tags":["article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29533","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29533","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29535","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29535","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29536","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29536","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29539","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29539","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29541","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29541","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29548","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29548","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29550","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29550","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1786","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1786.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1787","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1787.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1788","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1788.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1789","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1789.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1790","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1790.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1791","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1791.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1792","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1792.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1802","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2183278","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186734","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186735","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1802.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0547","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0547","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0547","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-0547","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28427","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28427","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28427","tags":["advisory"]},{"url":"https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr","tags":["article"]},{"url":"https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29479","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29479","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29479","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-29479","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1803","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1803.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1804","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1804.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1805","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1805.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1806","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1806.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1809","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1809.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1810","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1810.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1811","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1811.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2072","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2072.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2073","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2073.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2075","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2075.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2076.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2077","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2077.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2078.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2084","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2084.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2085","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2085.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:2076","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:2078","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232064-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210212","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-0547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29550","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232467-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232490-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232552-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-1999","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-13/#CVE-2023-1999","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6078-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6078-2","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-1999","title":"Use after free in libwebp","description":"There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.","status":"published","published":"2023-06-20T11:28:52.547Z","modified":"2025-02-13T16:39:44.993Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:35:31.657022Z"}],"euvd":[{"id":"EUVD-2023-24179","description":"There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.","status":"published","published":"2023-06-20T11:28:52Z","modified":"2025-02-13T16:39:44Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:51.861062Z"}],"ghsa":[{"id":"GHSA-8x9p-cw2c-6253","title":"There exists a use after free/double free in libwebp. An attacker can use the...","description":"There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. ","status":"published","published":"2023-06-20T12:30:16Z","modified":"2025-02-13T18:32:42Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-415","CWE-416"],"updated_at":"2026-11-02T14:59:55.900946Z"}],"nvd":[{"id":"CVE-2023-1999","description":"There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.","status":"published","published":"2023-06-20T12:15:09.6Z","modified":"2026-06-17T05:29:14.063Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-416","CWE-415"],"updated_at":"2026-11-02T14:08:12.414559Z"}],"osv":[{"id":"ALPINE-CVE-2023-1999","description":"There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.","status":"published","published":"2023-06-20T12:15:09.6Z","modified":"2026-11-03T06:32:58.923821782Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"AZL-27181","title":"CVE-2023-1999 affecting package libwebp for versions less than 1.3.2-1","description":"There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.","status":"published","published":"2023-06-20T12:15:09Z","modified":"2026-04-21T04:24:06.945732Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"BELL-CVE-2023-1999","title":"CVE-2023-1999 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:57.786749Z","modified":"2026-09-06T07:15:21.218730233Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-1999","title":"Use after free in libwebp","description":"There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.","status":"published","published":"2023-06-20T11:28:52.547Z","modified":"2026-10-28T02:30:44.481314445Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:44:30.334753Z"},{"id":"DEBIAN-CVE-2023-1999","description":"There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.","status":"published","published":"2023-06-20T12:15:09.6Z","modified":"2026-10-26T18:00:25.92772969Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"JLSEC-2026-440","description":"There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.","status":"published","published":"2026-05-04T13:35:07.628Z","modified":"2026-07-18T00:02:04.335155508Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2023-1317","title":"libwebp security update","description":"This is an image format that does lossy compression of digital photographic images. WebP consists of a codec based on VP8, and a container based on RIFF. Webmasters, web developers and browser developers can use WebP to compress, archive and distribute digital images more efficiently.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability was found in libwebp (affected version unknown). It has been declared as critical. Affected by this vulnerability is an unknown code of the component Image File Handler. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2023-1999)","status":"published","published":"2023-06-03T11:05:47Z","modified":"2026-08-18T01:17:41.542004724Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1684","title":"firefox security update","description":"Mozilla Firefox is a standalone web browser, designed for standards compliance and performance.  Its functionality can be enhanced via a plethora of extensions.\r\n\r\nSecurity Fix(es):\r\n\r\nThere exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. \n(CVE-2023-1999)","status":"published","published":"2023-09-28T11:06:08Z","modified":"2026-08-18T01:16:54.719612202Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1685","title":"firefox security update","description":"Mozilla Firefox is a standalone web browser, designed for standards compliance and performance.  Its functionality can be enhanced via a plethora of extensions.\r\n\r\nSecurity Fix(es):\r\n\r\nThere exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. \n(CVE-2023-1999)","status":"published","published":"2023-09-28T11:06:08Z","modified":"2026-08-18T01:16:49.014417799Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2026-3213","title":"mozjs102 security update","description":"SpiderMonkey is the code-name for Mozilla Firefox\u0026amp;apos;s C++ implementation of JavaScript. It is intended to be embedded in other applications that provide host environments for JavaScript.\r\n\r\nSecurity Fix(es):\n\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u0026lt; 102.10 and Firefox ESR \u0026lt; 102.10.(CVE-2023-1945)\n\nThere exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.(CVE-2023-1999)\n\nA website could have obscured the fullscreen notification by using a combination of \u0026lt;code\u0026gt;window.open\u0026lt;/code\u0026gt;, fullscreen requests, \u0026lt;code\u0026gt;window.name\u0026lt;/code\u0026gt; assignments, and \u0026lt;code\u0026gt;setInterval\u0026lt;/code\u0026gt; calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29533)\n\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29535)\n\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29536)\n\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29539)\n\nFirefox did not properly handle downloads of files ending in \u0026lt;code\u0026gt;.desktop\u0026lt;/code\u0026gt;, which can be interpreted to run attacker-controlled commands. \u0026lt;br\u0026gt;*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29541)\n\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29548)\n\nMemory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29550)\n\nIn multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32205)\n\nAn out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32206)\n\nA missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32207)\n\nA type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32211)\n\nAn attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32212)\n\nWhen reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32213)\n\nMozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32215)\n\nThe error page for sites with invalid TLS certificates was missing the\nactivation-delay Firefox uses to protect prompts and permission dialogs\nfrom attacks that exploit human response time delays. If a malicious\npage elicited user clicks in precise locations immediately before\nnavigating to a site with a certificate error and made the renderer\nextremely busy at the same time, it could create a gap between when\nthe error page was loaded and when the display actually refreshed.\nWith the right timing the elicited clicks could land in that gap and \nactivate the button that overrides the certificate error for that site. This vulnerability affects Firefox ESR \u0026lt; 102.12, Firefox \u0026lt; 114, and Thunderbird \u0026lt; 102.12.(CVE-2023-34414)\n\nMemory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u0026lt; 102.12, Firefox \u0026lt; 114, and Thunderbird \u0026lt; 102.12.(CVE-2023-34416)\n\nAn attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox \u0026lt; 115, Firefox ESR \u0026lt; 102.13, and Thunderbird \u0026lt; 102.13.(CVE-2023-37201)\n\nCross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox \u0026lt; 115, Firefox ESR \u0026lt; 102.13, and Thunderbird \u0026lt; 102.13.(CVE-2023-37202)\n\nA website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox \u0026lt; 115, Firefox ESR \u0026lt; 102.13, and Thunderbird \u0026lt; 102.13.(CVE-2023-37207)\n\nWhen opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox \u0026lt; 115, Firefox ESR \u0026lt; 102.13, and Thunderbird \u0026lt; 102.13.(CVE-2023-37208)\n\nMemory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 115, Firefox ESR \u0026lt; 102.13, and Thunderbird \u0026lt; 102.13.(CVE-2023-37211)\n\nOffscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4045)\n\nIn some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4046)\n\nA bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4047)\n\nAn out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4048)\n\nRace conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4049)\n\nIn some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash which could have led to a sandbox escape. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4050)\n\nWhen the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4055)\n\nMemory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4056)\n\nWhen receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox \u0026lt; 117, Firefox ESR \u0026lt; 102.15, Firefox ESR \u0026lt; 115.2, Thunderbird \u0026lt; 102.15, and Thunderbird \u0026lt; 115.2.(CVE-2023-4573)\n\nWhen creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox \u0026lt; 117, Firefox ESR \u0026lt; 102.15, Firefox ESR \u0026lt; 115.2, Thunderbird \u0026lt; 102.15, and Thunderbird \u0026lt; 115.2.(CVE-2023-4574)\n\nWhen creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox \u0026lt; 117, Firefox ESR \u0026lt; 102.15, Firefox ESR \u0026lt; 115.2, Thunderbird \u0026lt; 102.15, and Thunderbird \u0026lt; 115.2.(CVE-2023-4575)\n\nExcel `.xll` add-in files did not have a blocklist entry in Firefox\u0026apos;s executable blocklist which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects Firefox \u0026lt; 117, Firefox ESR \u0026lt; 102.15, Firefox ESR \u0026lt; 115.2, Thunderbird \u0026lt; 102.15, and Thunderbird \u0026lt; 115.2.(CVE-2023-4581)\n\nMemory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 117, Firefox ESR \u0026lt; 102.15, Firefox ESR \u0026lt; 115.2, Thunderbird \u0026lt; 102.15, and Thunderbird \u0026lt; 115.2.(CVE-2023-4584)\n\nHeap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)(CVE-2023-4863)","status":"published","published":"2026-08-01T11:12:05Z","modified":"2026-08-18T01:21:25.970630414Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3214","title":"mozjs102 security update","description":"SpiderMonkey is the code-name for Mozilla Firefox\u0026amp;apos;s C++ implementation of JavaScript. It is intended to be embedded in other applications that provide host environments for JavaScript.\r\n\r\nSecurity Fix(es):\n\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u0026lt; 102.10 and Firefox ESR \u0026lt; 102.10.(CVE-2023-1945)\n\nThere exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.(CVE-2023-1999)\n\nA website could have obscured the fullscreen notification by using a combination of \u0026lt;code\u0026gt;window.open\u0026lt;/code\u0026gt;, fullscreen requests, \u0026lt;code\u0026gt;window.name\u0026lt;/code\u0026gt; assignments, and \u0026lt;code\u0026gt;setInterval\u0026lt;/code\u0026gt; calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29533)\n\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29535)\n\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29536)\n\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29539)\n\nFirefox did not properly handle downloads of files ending in \u0026lt;code\u0026gt;.desktop\u0026lt;/code\u0026gt;, which can be interpreted to run attacker-controlled commands. \u0026lt;br\u0026gt;*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29541)\n\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29548)\n\nMemory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29550)\n\nIn multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32205)\n\nAn out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32206)\n\nA missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32207)\n\nA type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32211)\n\nAn attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32212)\n\nWhen reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32213)\n\nMozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32215)\n\nThe error page for sites with invalid TLS certificates was missing the\nactivation-delay Firefox uses to protect prompts and permission dialogs\nfrom attacks that exploit human response time delays. If a malicious\npage elicited user clicks in precise locations immediately before\nnavigating to a site with a certificate error and made the renderer\nextremely busy at the same time, it could create a gap between when\nthe error page was loaded and when the display actually refreshed.\nWith the right timing the elicited clicks could land in that gap and \nactivate the button that overrides the certificate error for that site. This vulnerability affects Firefox ESR \u0026lt; 102.12, Firefox \u0026lt; 114, and Thunderbird \u0026lt; 102.12.(CVE-2023-34414)\n\nMemory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u0026lt; 102.12, Firefox \u0026lt; 114, and Thunderbird \u0026lt; 102.12.(CVE-2023-34416)\n\nAn attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox \u0026lt; 115, Firefox ESR \u0026lt; 102.13, and Thunderbird \u0026lt; 102.13.(CVE-2023-37201)\n\nCross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox \u0026lt; 115, Firefox ESR \u0026lt; 102.13, and Thunderbird \u0026lt; 102.13.(CVE-2023-37202)\n\nA website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox \u0026lt; 115, Firefox ESR \u0026lt; 102.13, and Thunderbird \u0026lt; 102.13.(CVE-2023-37207)\n\nWhen opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox \u0026lt; 115, Firefox ESR \u0026lt; 102.13, and Thunderbird \u0026lt; 102.13.(CVE-2023-37208)\n\nMemory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 115, Firefox ESR \u0026lt; 102.13, and Thunderbird \u0026lt; 102.13.(CVE-2023-37211)\n\nOffscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4045)\n\nIn some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4046)\n\nA bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4047)\n\nAn out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4048)\n\nRace conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4049)\n\nIn some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash which could have led to a sandbox escape. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4050)\n\nWhen the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4055)\n\nMemory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4056)\n\nWhen receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox \u0026lt; 117, Firefox ESR \u0026lt; 102.15, Firefox ESR \u0026lt; 115.2, Thunderbird \u0026lt; 102.15, and Thunderbird \u0026lt; 115.2.(CVE-2023-4573)\n\nWhen creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox \u0026lt; 117, Firefox ESR \u0026lt; 102.15, Firefox ESR \u0026lt; 115.2, Thunderbird \u0026lt; 102.15, and Thunderbird \u0026lt; 115.2.(CVE-2023-4574)\n\nWhen creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox \u0026lt; 117, Firefox ESR \u0026lt; 102.15, Firefox ESR \u0026lt; 115.2, Thunderbird \u0026lt; 102.15, and Thunderbird \u0026lt; 115.2.(CVE-2023-4575)\n\nExcel `.xll` add-in files did not have a blocklist entry in Firefox\u0026apos;s executable blocklist which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects Firefox \u0026lt; 117, Firefox ESR \u0026lt; 102.15, Firefox ESR \u0026lt; 115.2, Thunderbird \u0026lt; 102.15, and Thunderbird \u0026lt; 115.2.(CVE-2023-4581)\n\nMemory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 117, Firefox ESR \u0026lt; 102.15, Firefox ESR \u0026lt; 115.2, Thunderbird \u0026lt; 102.15, and Thunderbird \u0026lt; 115.2.(CVE-2023-4584)","status":"published","published":"2026-08-01T11:12:05Z","modified":"2026-08-18T01:21:25.962449061Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3215","title":"mozjs102 security update","description":"SpiderMonkey is the code-name for Mozilla Firefox\u0026amp;apos;s C++ implementation of JavaScript. It is intended to be embedded in other applications that provide host environments for JavaScript.\r\n\r\nSecurity Fix(es):\n\nUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u0026lt; 102.10 and Firefox ESR \u0026lt; 102.10.(CVE-2023-1945)\n\nThere exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.(CVE-2023-1999)\n\nA website could have obscured the fullscreen notification by using a combination of \u0026lt;code\u0026gt;window.open\u0026lt;/code\u0026gt;, fullscreen requests, \u0026lt;code\u0026gt;window.name\u0026lt;/code\u0026gt; assignments, and \u0026lt;code\u0026gt;setInterval\u0026lt;/code\u0026gt; calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29533)\n\nFollowing a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29535)\n\nAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29536)\n\nWhen handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29539)\n\nFirefox did not properly handle downloads of files ending in \u0026lt;code\u0026gt;.desktop\u0026lt;/code\u0026gt;, which can be interpreted to run attacker-controlled commands. \u0026lt;br\u0026gt;*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29541)\n\nA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29548)\n\nMemory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 112, Focus for Android \u0026lt; 112, Firefox ESR \u0026lt; 102.10, Firefox for Android \u0026lt; 112, and Thunderbird \u0026lt; 102.10.(CVE-2023-29550)\n\nIn multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32205)\n\nAn out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32206)\n\nA missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32207)\n\nA type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32211)\n\nAn attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32212)\n\nWhen reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32213)\n\nMozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 113, Firefox ESR \u0026lt; 102.11, and Thunderbird \u0026lt; 102.11.(CVE-2023-32215)\n\nThe error page for sites with invalid TLS certificates was missing the\nactivation-delay Firefox uses to protect prompts and permission dialogs\nfrom attacks that exploit human response time delays. If a malicious\npage elicited user clicks in precise locations immediately before\nnavigating to a site with a certificate error and made the renderer\nextremely busy at the same time, it could create a gap between when\nthe error page was loaded and when the display actually refreshed.\nWith the right timing the elicited clicks could land in that gap and \nactivate the button that overrides the certificate error for that site. This vulnerability affects Firefox ESR \u0026lt; 102.12, Firefox \u0026lt; 114, and Thunderbird \u0026lt; 102.12.(CVE-2023-34414)\n\nMemory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u0026lt; 102.12, Firefox \u0026lt; 114, and Thunderbird \u0026lt; 102.12.(CVE-2023-34416)\n\nAn attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox \u0026lt; 115, Firefox ESR \u0026lt; 102.13, and Thunderbird \u0026lt; 102.13.(CVE-2023-37201)\n\nCross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox \u0026lt; 115, Firefox ESR \u0026lt; 102.13, and Thunderbird \u0026lt; 102.13.(CVE-2023-37202)\n\nA website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox \u0026lt; 115, Firefox ESR \u0026lt; 102.13, and Thunderbird \u0026lt; 102.13.(CVE-2023-37207)\n\nWhen opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox \u0026lt; 115, Firefox ESR \u0026lt; 102.13, and Thunderbird \u0026lt; 102.13.(CVE-2023-37208)\n\nMemory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 115, Firefox ESR \u0026lt; 102.13, and Thunderbird \u0026lt; 102.13.(CVE-2023-37211)\n\nOffscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4045)\n\nIn some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4046)\n\nA bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4047)\n\nAn out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4048)\n\nRace conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4049)\n\nIn some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash which could have led to a sandbox escape. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4050)\n\nWhen the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4055)\n\nMemory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 116, Firefox ESR \u0026lt; 102.14, and Firefox ESR \u0026lt; 115.1.(CVE-2023-4056)\n\nWhen receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox \u0026lt; 117, Firefox ESR \u0026lt; 102.15, Firefox ESR \u0026lt; 115.2, Thunderbird \u0026lt; 102.15, and Thunderbird \u0026lt; 115.2.(CVE-2023-4573)\n\nWhen creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox \u0026lt; 117, Firefox ESR \u0026lt; 102.15, Firefox ESR \u0026lt; 115.2, Thunderbird \u0026lt; 102.15, and Thunderbird \u0026lt; 115.2.(CVE-2023-4574)\n\nWhen creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox \u0026lt; 117, Firefox ESR \u0026lt; 102.15, Firefox ESR \u0026lt; 115.2, Thunderbird \u0026lt; 102.15, and Thunderbird \u0026lt; 115.2.(CVE-2023-4575)\n\nExcel `.xll` add-in files did not have a blocklist entry in Firefox\u0026apos;s executable blocklist which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects Firefox \u0026lt; 117, Firefox ESR \u0026lt; 102.15, Firefox ESR \u0026lt; 115.2, Thunderbird \u0026lt; 102.15, and Thunderbird \u0026lt; 115.2.(CVE-2023-4581)\n\nMemory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 117, Firefox ESR \u0026lt; 102.15, Firefox ESR \u0026lt; 115.2, Thunderbird \u0026lt; 102.15, and Thunderbird \u0026lt; 115.2.(CVE-2023-4584)","status":"published","published":"2026-08-01T11:12:05Z","modified":"2026-08-18T01:21:25.265732115Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2023:1785","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-22T22:24:26Z","modified":"2026-08-20T10:03:47Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1786","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-22T22:24:46Z","modified":"2026-08-20T10:03:47Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1787","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-22T22:24:36Z","modified":"2026-08-20T10:03:48Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1788","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-22T22:24:56Z","modified":"2026-08-20T10:03:48Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1789","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-22T22:24:17Z","modified":"2026-08-20T10:03:49Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1790","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-22T22:24:08Z","modified":"2026-08-20T10:03:50Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1791","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-22T22:23:57Z","modified":"2026-08-20T10:03:50Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1792","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-22T22:23:46Z","modified":"2026-08-20T10:03:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1802","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-22T22:25:15Z","modified":"2026-08-20T10:03:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1803","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-22T22:25:05Z","modified":"2026-08-20T10:03:52Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1804","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-22T22:24:23Z","modified":"2026-08-20T10:03:53Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1805","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-22T22:24:14Z","modified":"2026-08-20T10:03:53Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1806","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-22T22:24:04Z","modified":"2026-08-20T10:03:54Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1809","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-22T22:24:52Z","modified":"2026-08-20T10:03:55Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1810","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-22T22:24:43Z","modified":"2026-08-20T10:03:55Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1811","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-22T22:24:33Z","modified":"2026-08-20T10:03:56Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2072","title":"Red Hat Security Advisory: libwebp security update","status":"published","published":"2024-09-16T11:30:55Z","modified":"2025-11-22T12:48:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2073","title":"Red Hat Security Advisory: libwebp security update","status":"published","published":"2024-09-16T11:30:46Z","modified":"2025-11-22T12:48:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2075","title":"Red Hat Security Advisory: libwebp security update","status":"published","published":"2024-09-16T11:30:37Z","modified":"2025-11-22T12:48:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2076","title":"Red Hat Security Advisory: libwebp security update","status":"published","published":"2024-09-16T11:31:05Z","modified":"2025-11-22T12:48:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2077","title":"Red Hat Security Advisory: libwebp security update","status":"published","published":"2024-09-16T11:29:56Z","modified":"2026-06-26T12:21:19.133747421Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2078","title":"Red Hat Security Advisory: libwebp security update","status":"published","published":"2024-09-16T11:29:47Z","modified":"2025-11-22T12:48:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2084","title":"Red Hat Security Advisory: libwebp security update","status":"published","published":"2024-09-16T11:30:04Z","modified":"2025-11-22T12:48:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2085","title":"Red Hat Security Advisory: libwebp security update","status":"published","published":"2024-09-16T11:30:13Z","modified":"2025-11-22T12:48:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"UBUNTU-CVE-2023-1999","description":"There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.","status":"published","published":"2023-05-08T00:00:00Z","modified":"2026-10-17T12:56:03.828290667Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:18.756095Z"},{"id":"ALSA-2023:2076","title":"Important: libwebp security update","description":"The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.\n\nSecurity Fix(es):\n\n* Mozilla: libwebp: Double-free in libwebp (CVE-2023-1999)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-05-02T00:00:00Z","modified":"2026-10-29T11:01:36.432442361Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:2078","title":"Important: libwebp security update","description":"The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.\n\nSecurity Fix(es):\n\n* Mozilla: libwebp: Double-free in libwebp (CVE-2023-1999)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-05-02T00:00:00Z","modified":"2026-10-29T11:30:53.455740021Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2023-1696537325","title":"Fix of 10 CVEs","description":"\n   * SECURITY UPDATE: a heap-based buffer overflow\n     - debian/patches/CVE-2018-25009.patch: add additional check to avoid\n       read over the header\n     - CVE-2018-25009\n   * SECURITY UPDATE: a heap-based buffer overflow\n     - debian/patches/CVE-2018-25010.patch: limit the filter size to not\n       exceed the image dimensions\n     - CVE-2018-25010\n   * SECURITY UPDATE: fail on multiple image chunks\n     - debian/patches/CVE-2018-25011.patch: only 1 image chunk allowed\n     - CVE-2018-25011\n   * SECURITY UPDATE: a heap-based buffer overflow\n     - debian/patches/CVE-2018-25013_4.patch: wait for all threads to\n       be done in DecodeRemaining.\n     - CVE-2018-25013\n     - CVE-2018-25014\n   * SECURITY UPDATE: a heap-based buffer overflow\n     - debian/patches/CVE-2020-36328.patch: fix invalid check for buffer\n       size\n     - CVE-2020-36328\n   * SECURITY UPDATE: a use-after-free was found due to a thread being\n     killed too early\n     - debian/patches/CVE-2020-36329.patch: fix for thread race\n       heap-use-after-free\n     - CVE-2020-36329\n   * SECURITY UPDATE: an out-of-bounds read\n     - debian/patches/CVE-2020-36330.patch: fix riff size checks\n     - CVE-2020-36330\n   * SECURITY UPDATE: an out-of-bounds read\n     - debian/patches/CVE-2020-36331.patch: validate chunk_size\n     - CVE-2020-36331\n   * SECURITY UPDATE: a use after free/double free\n     - debian/patches/CVE-2023-1999.patch: clear result-\u003ebw on error\n     - CVE-2023-1999","status":"published","published":"2023-10-05T20:22:09Z","modified":"2026-06-04T10:03:22.957732Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1696970233","title":"libwebp: Fix of 3 CVEs","description":"- CVE-2018-25013, CVE-2018-25014: wait for all threads to be done in\n  DecodeRemaining\n- CVE-2023-1999: fix a double free error","status":"published","published":"2023-10-10T20:37:18Z","modified":"2026-06-01T00:30:12.355835828Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1696970439","title":"libwebp: Fix of 3 CVEs","description":"- CVE-2018-25013, CVE-2018-25014: wait for all threads to be done in\n  DecodeRemaining\n- CVE-2023-1999: fix a double free error","status":"published","published":"2023-10-10T20:40:43Z","modified":"2026-06-01T00:33:22.094197435Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1697135462","title":"libwebp: Fix of CVE-2023-1999","description":"- CVE-2023-1999: avoids a double free","status":"published","published":"2023-10-12T18:31:06Z","modified":"2026-06-01T00:33:24.827253292Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1697136085","title":"libwebp: Fix of CVE-2023-1999","description":"- CVE-2023-1999: avoids a double free","status":"published","published":"2023-10-12T18:41:30Z","modified":"2026-06-01T00:33:01.933793786Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"DLA-3391-1","title":"firefox-esr - security update","status":"published","published":"2023-04-12T00:00:00Z","modified":"2026-03-09T01:21:45.634526Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-3400-1","title":"thunderbird - security update","status":"published","published":"2023-04-24T00:00:00Z","modified":"2026-03-09T01:22:11.9185Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-3439-1","title":"libwebp - security update","status":"published","published":"2023-05-31T00:00:00Z","modified":"2026-03-09T01:23:34.591147Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5385-1","title":"firefox-esr - security update","status":"published","published":"2023-04-12T00:00:00Z","modified":"2026-03-09T02:09:34.184132Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"DSA-5392-1","title":"thunderbird - security update","status":"published","published":"2023-04-22T00:00:00Z","modified":"2026-03-09T02:10:45.754932Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"DSA-5408-1","title":"libwebp - security update","status":"published","published":"2023-05-21T00:00:00Z","modified":"2026-03-09T02:10:46.90193Z","updated_at":"2026-11-02T15:46:17.543497Z"}]},"sources_more":{"osv":9}}