exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2021-4231-04

Red Hat Security Advisory 2021-4231-04
Posted Nov 10, 2021
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2021-4231-04 - The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format. Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently. Issues addressed include an out of bounds read vulnerability.

tags | advisory, web
systems | linux, redhat
advisories | CVE-2018-25009, CVE-2018-25010, CVE-2018-25012, CVE-2018-25013, CVE-2018-25014, CVE-2020-36330, CVE-2020-36331, CVE-2020-36332
SHA-256 | bd566ffa67ac9dc7d0a55d2b189d9d9b063252f3bacda91e964ddd12afe24f29

Red Hat Security Advisory 2021-4231-04

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Moderate: libwebp security update
Advisory ID: RHSA-2021:4231-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:4231
Issue date: 2021-11-09
CVE Names: CVE-2018-25009 CVE-2018-25010 CVE-2018-25012
CVE-2018-25013 CVE-2018-25014 CVE-2020-36330
CVE-2020-36331 CVE-2020-36332
====================================================================
1. Summary:

An update for libwebp is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64

3. Description:

The libwebp packages provide a library and tools for the WebP graphics
format. WebP is an image format with a lossy compression of digital
photographic images. WebP consists of a codec based on the VP8 format, and
a container based on the Resource Interchange File Format (RIFF).
Webmasters, web developers and browser developers can use WebP to compress,
archive, and distribute digital images more efficiently.

Security Fix(es):

* libwebp: out-of-bounds read in WebPMuxCreateInternal (CVE-2018-25009)

* libwebp: out-of-bounds read in ApplyFilter() (CVE-2018-25010)

* libwebp: out-of-bounds read in WebPMuxCreateInternal() (CVE-2018-25012)

* libwebp: out-of-bounds read in ShiftBytes() (CVE-2018-25013)

* libwebp: use of uninitialized value in ReadSymbol() (CVE-2018-25014)

* libwebp: out-of-bounds read in ChunkVerifyAndAssign() in mux/muxread.c
(CVE-2020-36330)

* libwebp: out-of-bounds read in ChunkAssignData() in mux/muxinternal.c
(CVE-2020-36331)

* libwebp: excessive memory allocation when reading a file (CVE-2020-36332)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.5 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1956853 - CVE-2020-36330 libwebp: out-of-bounds read in ChunkVerifyAndAssign() in mux/muxread.c
1956856 - CVE-2020-36331 libwebp: out-of-bounds read in ChunkAssignData() in mux/muxinternal.c
1956868 - CVE-2020-36332 libwebp: excessive memory allocation when reading a file
1956917 - CVE-2018-25009 libwebp: out-of-bounds read in WebPMuxCreateInternal
1956918 - CVE-2018-25010 libwebp: out-of-bounds read in ApplyFilter()
1956922 - CVE-2018-25012 libwebp: out-of-bounds read in WebPMuxCreateInternal()
1956926 - CVE-2018-25013 libwebp: out-of-bounds read in ShiftBytes()
1956927 - CVE-2018-25014 libwebp: use of uninitialized value in ReadSymbol()

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:
libwebp-1.0.0-5.el8.src.rpm

aarch64:
libwebp-1.0.0-5.el8.aarch64.rpm
libwebp-debuginfo-1.0.0-5.el8.aarch64.rpm
libwebp-debugsource-1.0.0-5.el8.aarch64.rpm
libwebp-devel-1.0.0-5.el8.aarch64.rpm
libwebp-java-debuginfo-1.0.0-5.el8.aarch64.rpm
libwebp-tools-debuginfo-1.0.0-5.el8.aarch64.rpm

ppc64le:
libwebp-1.0.0-5.el8.ppc64le.rpm
libwebp-debuginfo-1.0.0-5.el8.ppc64le.rpm
libwebp-debugsource-1.0.0-5.el8.ppc64le.rpm
libwebp-devel-1.0.0-5.el8.ppc64le.rpm
libwebp-java-debuginfo-1.0.0-5.el8.ppc64le.rpm
libwebp-tools-debuginfo-1.0.0-5.el8.ppc64le.rpm

s390x:
libwebp-1.0.0-5.el8.s390x.rpm
libwebp-debuginfo-1.0.0-5.el8.s390x.rpm
libwebp-debugsource-1.0.0-5.el8.s390x.rpm
libwebp-devel-1.0.0-5.el8.s390x.rpm
libwebp-java-debuginfo-1.0.0-5.el8.s390x.rpm
libwebp-tools-debuginfo-1.0.0-5.el8.s390x.rpm

x86_64:
libwebp-1.0.0-5.el8.i686.rpm
libwebp-1.0.0-5.el8.x86_64.rpm
libwebp-debuginfo-1.0.0-5.el8.i686.rpm
libwebp-debuginfo-1.0.0-5.el8.x86_64.rpm
libwebp-debugsource-1.0.0-5.el8.i686.rpm
libwebp-debugsource-1.0.0-5.el8.x86_64.rpm
libwebp-devel-1.0.0-5.el8.i686.rpm
libwebp-devel-1.0.0-5.el8.x86_64.rpm
libwebp-java-debuginfo-1.0.0-5.el8.i686.rpm
libwebp-java-debuginfo-1.0.0-5.el8.x86_64.rpm
libwebp-tools-debuginfo-1.0.0-5.el8.i686.rpm
libwebp-tools-debuginfo-1.0.0-5.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-25009
https://access.redhat.com/security/cve/CVE-2018-25010
https://access.redhat.com/security/cve/CVE-2018-25012
https://access.redhat.com/security/cve/CVE-2018-25013
https://access.redhat.com/security/cve/CVE-2018-25014
https://access.redhat.com/security/cve/CVE-2020-36330
https://access.redhat.com/security/cve/CVE-2020-36331
https://access.redhat.com/security/cve/CVE-2020-36332
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYYrdV9zjgjWX9erEAQjPKw//b87QnRCt7mK8HBE36Ryh32/KlNTbdNl6
KXkxyVMUVTaofuqdPoXmJOCUkaVUIxypxj4rnYKDIkRiWMIjTs11j5N17GRbUzC8
j0BLMniOja5AoeYJaRd3hSaJEh4Pwq7a1kYhlxwcJxQ2XUHLBNa8++aItgRcpfOv
ANQKsfjppoLqTAvgSNwvbLEG+yiObS/oj3wxZpIL1LVgAFiHQZBgAQYci6Oi712Y
O3zyuq5jWkGcPtvp+v62fv3vVM4lqMcDna59O8DpcPmgwDgnJjQv8hd6WsIjMc6l
ofXaipBrUlr5viTMDBMt36Vel2M4mvIcfrA+4walNO0mGpMrB/2ukqyn2yMzO8dl
zmMGw4XsBFVKvqjkjiIApyn2UtmPelOyjDwr0WnUvrx/CprW/cxhA1Ou1tSPwMEE
0DIvANBtNLMm//1juXKSUUew8lKy32I06hrp9bLq44p15DeC1cab7V1cb1e+urWm
Pa3ZiUHvFpiKK5hRrAx64I0ZDle0vgwe92OIi5ibT+FT6F5dL4cnbhv/6pDi/saP
YDZlQNidSs8QYRWRJdXCH7EDCRyncZjFKTrnuJhpJ/Iz8cCIl0JjtnbeVaW7iHsI
qnqSANHZV+iVrSJEav8JLmWWkrf9HYlixI6udpG5cZmNt4Be9q6f8WIguq7mPy3k
lJzqUU7nXTw=nPk5
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

March 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    13 Files
  • 3
    Mar 3rd
    15 Files
  • 4
    Mar 4th
    0 Files
  • 5
    Mar 5th
    0 Files
  • 6
    Mar 6th
    16 Files
  • 7
    Mar 7th
    31 Files
  • 8
    Mar 8th
    16 Files
  • 9
    Mar 9th
    13 Files
  • 10
    Mar 10th
    9 Files
  • 11
    Mar 11th
    0 Files
  • 12
    Mar 12th
    0 Files
  • 13
    Mar 13th
    10 Files
  • 14
    Mar 14th
    6 Files
  • 15
    Mar 15th
    17 Files
  • 16
    Mar 16th
    22 Files
  • 17
    Mar 17th
    13 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    16 Files
  • 21
    Mar 21st
    13 Files
  • 22
    Mar 22nd
    5 Files
  • 23
    Mar 23rd
    6 Files
  • 24
    Mar 24th
    47 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    50 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    7 Files
  • 30
    Mar 30th
    31 Files
  • 31
    Mar 31st
    15 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close