p PatchFirst

CVE-2020-36328

CVE-2020-36328

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 9.8 · Critical · EPSS 2.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libwebp

    Versions
    • libwebp 1.0.1: Affected

    No fix published

  • libwebp Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.6.1-2.1

    Update to 0.6.1-2.1

  • libwebp Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.6.1-2.1

    Update to 0.6.1-2.1

  • libwebp Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.6.1-2.1

    Update to 0.6.1-2.1

  • libwebp Ubuntu:Pro:14.04:LTS

    Versions
    • 0.3.0-3
    • 0.4.0-4
    Affected ranges
    • ECOSYSTEM: < 0.4.0-4ubuntu0.1~esm1

    Update to 0.4.0-4ubuntu0.1~esm1

  • libwebp Ubuntu:Pro:16.04:LTS

    Versions
    • 0.4.3-1.3
    • 0.4.3-1.3build1
    • 0.4.4-1
    Affected ranges
    • ECOSYSTEM: < 0.4.4-1ubuntu0.1~esm1

    Update to 0.4.4-1ubuntu0.1~esm1

  • libwebp Ubuntu:18.04:LTS

    Versions
    • 0.6.0-3
    • 0.6.0-4
    • 0.6.1-1
    • 0.6.1-2
    Affected ranges
    • ECOSYSTEM: < 0.6.1-2ubuntu0.18.04.1

    Update to 0.6.1-2ubuntu0.18.04.1

  • libwebp Ubuntu:20.04:LTS

    Versions
    • 0.6.1-2
    Affected ranges
    • ECOSYSTEM: < 0.6.1-2ubuntu0.20.04.1

    Update to 0.6.1-2ubuntu0.20.04.1

Original sources

Check your server →