Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.3789
libwebp security update
10 November 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: libwebp
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2020-36332 CVE-2020-36331 CVE-2020-36330
CVE-2018-25014 CVE-2018-25013 CVE-2018-25012
CVE-2018-25010 CVE-2018-25009
Reference: ESB-2021.2485.2
ESB-2021.2103
ESB-2021.2102
ESB-2021.2036
Original Bulletin:
https://access.redhat.com/errata/RHSA-2021:4231
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: libwebp security update
Advisory ID: RHSA-2021:4231-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:4231
Issue date: 2021-11-09
CVE Names: CVE-2018-25009 CVE-2018-25010 CVE-2018-25012
CVE-2018-25013 CVE-2018-25014 CVE-2020-36330
CVE-2020-36331 CVE-2020-36332
=====================================================================
1. Summary:
An update for libwebp is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64
3. Description:
The libwebp packages provide a library and tools for the WebP graphics
format. WebP is an image format with a lossy compression of digital
photographic images. WebP consists of a codec based on the VP8 format, and
a container based on the Resource Interchange File Format (RIFF).
Webmasters, web developers and browser developers can use WebP to compress,
archive, and distribute digital images more efficiently.
Security Fix(es):
* libwebp: out-of-bounds read in WebPMuxCreateInternal (CVE-2018-25009)
* libwebp: out-of-bounds read in ApplyFilter() (CVE-2018-25010)
* libwebp: out-of-bounds read in WebPMuxCreateInternal() (CVE-2018-25012)
* libwebp: out-of-bounds read in ShiftBytes() (CVE-2018-25013)
* libwebp: use of uninitialized value in ReadSymbol() (CVE-2018-25014)
* libwebp: out-of-bounds read in ChunkVerifyAndAssign() in mux/muxread.c
(CVE-2020-36330)
* libwebp: out-of-bounds read in ChunkAssignData() in mux/muxinternal.c
(CVE-2020-36331)
* libwebp: excessive memory allocation when reading a file (CVE-2020-36332)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.5 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1956853 - CVE-2020-36330 libwebp: out-of-bounds read in ChunkVerifyAndAssign() in mux/muxread.c
1956856 - CVE-2020-36331 libwebp: out-of-bounds read in ChunkAssignData() in mux/muxinternal.c
1956868 - CVE-2020-36332 libwebp: excessive memory allocation when reading a file
1956917 - CVE-2018-25009 libwebp: out-of-bounds read in WebPMuxCreateInternal
1956918 - CVE-2018-25010 libwebp: out-of-bounds read in ApplyFilter()
1956922 - CVE-2018-25012 libwebp: out-of-bounds read in WebPMuxCreateInternal()
1956926 - CVE-2018-25013 libwebp: out-of-bounds read in ShiftBytes()
1956927 - CVE-2018-25014 libwebp: use of uninitialized value in ReadSymbol()
6. Package List:
Red Hat Enterprise Linux AppStream (v. 8):
Source:
libwebp-1.0.0-5.el8.src.rpm
aarch64:
libwebp-1.0.0-5.el8.aarch64.rpm
libwebp-debuginfo-1.0.0-5.el8.aarch64.rpm
libwebp-debugsource-1.0.0-5.el8.aarch64.rpm
libwebp-devel-1.0.0-5.el8.aarch64.rpm
libwebp-java-debuginfo-1.0.0-5.el8.aarch64.rpm
libwebp-tools-debuginfo-1.0.0-5.el8.aarch64.rpm
ppc64le:
libwebp-1.0.0-5.el8.ppc64le.rpm
libwebp-debuginfo-1.0.0-5.el8.ppc64le.rpm
libwebp-debugsource-1.0.0-5.el8.ppc64le.rpm
libwebp-devel-1.0.0-5.el8.ppc64le.rpm
libwebp-java-debuginfo-1.0.0-5.el8.ppc64le.rpm
libwebp-tools-debuginfo-1.0.0-5.el8.ppc64le.rpm
s390x:
libwebp-1.0.0-5.el8.s390x.rpm
libwebp-debuginfo-1.0.0-5.el8.s390x.rpm
libwebp-debugsource-1.0.0-5.el8.s390x.rpm
libwebp-devel-1.0.0-5.el8.s390x.rpm
libwebp-java-debuginfo-1.0.0-5.el8.s390x.rpm
libwebp-tools-debuginfo-1.0.0-5.el8.s390x.rpm
x86_64:
libwebp-1.0.0-5.el8.i686.rpm
libwebp-1.0.0-5.el8.x86_64.rpm
libwebp-debuginfo-1.0.0-5.el8.i686.rpm
libwebp-debuginfo-1.0.0-5.el8.x86_64.rpm
libwebp-debugsource-1.0.0-5.el8.i686.rpm
libwebp-debugsource-1.0.0-5.el8.x86_64.rpm
libwebp-devel-1.0.0-5.el8.i686.rpm
libwebp-devel-1.0.0-5.el8.x86_64.rpm
libwebp-java-debuginfo-1.0.0-5.el8.i686.rpm
libwebp-java-debuginfo-1.0.0-5.el8.x86_64.rpm
libwebp-tools-debuginfo-1.0.0-5.el8.i686.rpm
libwebp-tools-debuginfo-1.0.0-5.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-25009
https://access.redhat.com/security/cve/CVE-2018-25010
https://access.redhat.com/security/cve/CVE-2018-25012
https://access.redhat.com/security/cve/CVE-2018-25013
https://access.redhat.com/security/cve/CVE-2018-25014
https://access.redhat.com/security/cve/CVE-2020-36330
https://access.redhat.com/security/cve/CVE-2020-36331
https://access.redhat.com/security/cve/CVE-2020-36332
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYYrdV9zjgjWX9erEAQjPKw//b87QnRCt7mK8HBE36Ryh32/KlNTbdNl6
KXkxyVMUVTaofuqdPoXmJOCUkaVUIxypxj4rnYKDIkRiWMIjTs11j5N17GRbUzC8
j0BLMniOja5AoeYJaRd3hSaJEh4Pwq7a1kYhlxwcJxQ2XUHLBNa8++aItgRcpfOv
ANQKsfjppoLqTAvgSNwvbLEG+yiObS/oj3wxZpIL1LVgAFiHQZBgAQYci6Oi712Y
O3zyuq5jWkGcPtvp+v62fv3vVM4lqMcDna59O8DpcPmgwDgnJjQv8hd6WsIjMc6l
ofXaipBrUlr5viTMDBMt36Vel2M4mvIcfrA+4walNO0mGpMrB/2ukqyn2yMzO8dl
zmMGw4XsBFVKvqjkjiIApyn2UtmPelOyjDwr0WnUvrx/CprW/cxhA1Ou1tSPwMEE
0DIvANBtNLMm//1juXKSUUew8lKy32I06hrp9bLq44p15DeC1cab7V1cb1e+urWm
Pa3ZiUHvFpiKK5hRrAx64I0ZDle0vgwe92OIi5ibT+FT6F5dL4cnbhv/6pDi/saP
YDZlQNidSs8QYRWRJdXCH7EDCRyncZjFKTrnuJhpJ/Iz8cCIl0JjtnbeVaW7iHsI
qnqSANHZV+iVrSJEav8JLmWWkrf9HYlixI6udpG5cZmNt4Be9q6f8WIguq7mPy3k
lJzqUU7nXTw=
=nPk5
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYYtRfeNLKJtyKPYoAQg5mg//V2kD/3GTBTezyBkRK45FtlJ6kXWQq17d
1kfE1jA6wS2EZkGNt46jaVT9e5UKOkWIFl8ye5X8ILgnWM0Jf+QezfrteW6NY3NZ
M90JO2WlIrzFKjzfWIT9UMG8AF3sb29SE8NMCX+EOB2OhtgcXRJr6Z+952dv8AjG
gncvAo5NJv0HZYurlkJQhP6tllYPdYhqCYpFAW/DgkQYlJKM7RSOZd4aHRDMHzdA
dTMw6UMfIKqnQfmuXB98MuzWuROK00jCGZBWLrQ79g1BGJ3m/5LF0LM1dT78LmiC
o15ANUVi1g03+AhKBwWnCo2k6FGVLn/UxhxTKSSTM8MWFekvilRjANgx2t7Q25TP
j82/CE3y5avMjWSBZTrdJkrIimu17qtA/v+hWqiOBcfbMRiZDIT9TMzmrj3Y+QU+
yy0+nb1LrYdIW3UsG3Fseic5cMgW2QFJKZbwW42N5lWI/3vvPDWoAwhHQTb9TlZR
aWDqe9zTrzsXjj+RNa56VHC85XPjY9XUSfIt92pm3sHBaHDDO1AtkqE70rQ6NcEb
aIJxISO0L4+/Dg0tXCaP9hYlq0u444CwpU+tEpRerEDvXWXVkq4BVUos0/lSxNT8
DjPGIKKH0RZkfAA6s6z/UhBmVA+qhvEvWUjxPhKfwNiOkEgwSufxgeTeoHEfvb7/
omaYfSPnUIY=
=C7w7
-----END PGP SIGNATURE-----