oss-sec mailing list archives

Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec

From: Rodrigo Freire <rfreire () redhat com>
Date: Fri, 22 Sep 2023 10:18:07 -0300

On Fri, Sep 22, 2023 at 8:43 AM Marc Deslauriers
<marc.deslauriers () canonical com> wrote:

We (Ubuntu) didn't include that second commit in our libwebp updates, and I
don't believe Red Hat/Fedora did either. If that second commit does have a
security impact, it probably needs a different CVE to clear up confusion.


And hope that time the CNA assigns the CVE to the right component...

- RF

Current thread:

CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec Solar Designer (Sep 21)
- Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec Hanno Böck (Sep 21)
  - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec Solar Designer (Sep 22)
    - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec Vincent Rabaud (Sep 22)
    - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec Solar Designer (Sep 22)
    - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec Vincent Rabaud (Sep 22)
  - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec Marc Deslauriers (Sep 22)
    - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec Rodrigo Freire (Sep 22)
- Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec Salvatore Bonaccorso (Sep 26)
  - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec Solar Designer (Sep 26)
    - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec Salvatore Bonaccorso (Sep 28)
    - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec Jeffrey Walton (Sep 28)
    - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec Emilio Pozuelo Monfort (Sep 28)