CVE-2023-1999
CVE-2023-1999 · Use after free in libwebp
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.
CVSS 5.3 · Medium · EPSS 1.0% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
libwebp
- Versions
- ≥ 0.4.2, < 1.3.1: Affected (custom)
- ≥ 0.4.2, < 1.3.0-8-ga486d800: Affected (custom)
Update to 1.3.1
firefox-esr Debian:12
- Affected ranges
- ECOSYSTEM: < 102.10.0esr-1
Update to 102.10.0esr-1
firefox-esr Debian:13
- Affected ranges
- ECOSYSTEM: < 102.10.0esr-1
Update to 102.10.0esr-1
firefox-esr Debian:14
- Affected ranges
- ECOSYSTEM: < 102.10.0esr-1
Update to 102.10.0esr-1
libwebp Debian:12
- Affected ranges
- ECOSYSTEM: < 1.2.4-0.2
Update to 1.2.4-0.2
libwebp Debian:13
- Affected ranges
- ECOSYSTEM: < 1.2.4-0.2
Update to 1.2.4-0.2
libwebp Debian:14
- Affected ranges
- ECOSYSTEM: < 1.2.4-0.2
Update to 1.2.4-0.2
thunderbird Debian:12
- Affected ranges
- ECOSYSTEM: < 1:102.10.0-1
Update to 1:102.10.0-1
thunderbird Debian:13
- Affected ranges
- ECOSYSTEM: < 1:102.10.0-1
Update to 1:102.10.0-1
thunderbird Debian:14
- Affected ranges
- ECOSYSTEM: < 1:102.10.0-1
Update to 1:102.10.0-1
libwebp Ubuntu:Pro:14.04:LTS
- Versions
- 0.3.0-3
- 0.4.0-4
- 0.4.0-4ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libwebp Ubuntu:Pro:16.04:LTS
- Versions
- 0.4.3-1.3
- 0.4.3-1.3build1
- 0.4.4-1
- 0.4.4-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: < 0.4.4-1ubuntu0.1~esm2
Update to 0.4.4-1ubuntu0.1~esm2
libwebp Ubuntu:18.04:LTS
- Versions
- 0.6.0-3
- 0.6.0-4
- 0.6.1-1
- 0.6.1-2
- 0.6.1-2ubuntu0.18.04.1
- Affected ranges
- ECOSYSTEM: < 0.6.1-2ubuntu0.18.04.2
Update to 0.6.1-2ubuntu0.18.04.2
mozjs52 Ubuntu:18.04:LTS
- Versions
- 52.3.1-0ubuntu3
- 52.3.1-7fakesync1
- 52.8.1-0ubuntu0.18.04.1
- 52.9.1-0ubuntu0.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs38 Ubuntu:18.04:LTS
- Versions
- 38.8.0~repack1-0ubuntu1
- 38.8.0~repack1-0ubuntu3
- 38.8.0~repack1-0ubuntu4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libwebp Ubuntu:20.04:LTS
- Versions
- 0.6.1-2
- 0.6.1-2ubuntu0.20.04.1
- Affected ranges
- ECOSYSTEM: < 0.6.1-2ubuntu0.20.04.2
Update to 0.6.1-2ubuntu0.20.04.2
mozjs68 Ubuntu:20.04:LTS
- Versions
- 68.5.0-1~fakesync
- 68.5.0-2~fakesync
- 68.6.0-1
- 68.6.0-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs52 Ubuntu:20.04:LTS
- Versions
- 52.9.1-1build1
- 52.9.1-1ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libwebp Ubuntu:22.04:LTS
- Versions
- 0.6.1-2.1
- 0.6.1-2.1build1
- 1.2.1-6
- 1.2.1-7
- 1.2.2-2
- Affected ranges
- ECOSYSTEM: < 1.2.2-2ubuntu0.22.04.1
Update to 1.2.2-2ubuntu0.22.04.1
mozjs78 Ubuntu:22.04:LTS
- Versions
- 78.13.0-1
- 78.15.0-2
- 78.15.0-4ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs91 Ubuntu:22.04:LTS
- Versions
- 91.5.1-0ubuntu1
- 91.6.0-1
- 91.6.0-2
- 91.7.0-2
- 91.10.0-0ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
thunderbird Ubuntu:22.04:LTS
- Versions
- 1:91.1.2+build1-0ubuntu1
- 1:91.3.0+build2-0ubuntu1
- 1:91.3.1+build1-0ubuntu1
- 1:91.3.2+build1-0ubuntu1
- 1:91.4.0+build1.1-0ubuntu1
- 1:91.4.0+build2-0ubuntu1
- 1:91.5.0+build1-0ubuntu1
- 1:91.5.1+build1-0ubuntu1
- 1:91.6.1+build1-0ubuntu1
- 1:91.7.0+build1-0ubuntu1
- 1:91.7.0+build2-0ubuntu1
- 1:91.8.0+build2-0ubuntu1
- 1:91.9.1+build1-0ubuntu0.22.04.1
- 1:91.11.0+build2-0ubuntu0.22.04.1
- 1:102.2.2+build1-0ubuntu0.22.04.1
- 1:102.4.2+build2-0ubuntu0.22.04.1
- 1:102.7.1+build2-0ubuntu0.22.04.1
- 1:102.8.0+build2-0ubuntu0.22.04.1
- 1:102.9.0+build1-0ubuntu0.22.04.1
- 1:102.10.0+build2-0ubuntu0.22.04.1
- 1:102.11.0+build1-0ubuntu0.22.04.1
- 1:102.13.0+build1-0ubuntu0.22.04.1
- 1:102.15.0+build1-0ubuntu0.22.04.1
- 1:102.15.1+build1-0ubuntu0.22.04.1
- 1:115.3.1+build1-0ubuntu0.22.04.2
- 1:115.4.1+build1-0ubuntu0.22.04.1
- 1:115.5.0+build1-0ubuntu0.22.04.1
- 1:115.6.0+build2-0ubuntu0.22.04.1
- 1:115.8.1+build1-0ubuntu0.22.04.1
- 1:115.9.0+build1-0ubuntu0.22.04.1
- 1:115.10.1+build1-0ubuntu0.22.04.1
- 1:115.11.0+build2-0ubuntu0.22.04.1
- 1:115.12.0+build3-0ubuntu0.22.04.1
- 1:115.13.0+build5-0ubuntu0.22.04.1
- 1:115.15.0+build1-0ubuntu0.22.04.1
- 1:115.16.0+build2-0ubuntu0.22.04.1
- 1:115.18.0+build1-0ubuntu0.22.04.1
- 1:128.12.0+build1-0ubuntu0.22.04.1
- 1:140.7.1+build1-0ubuntu0.22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
thunderbird Ubuntu:24.04:LTS
- Versions
- 1:115.3.1+build1-0ubuntu1
- 1:115.4.1+build1-0ubuntu1
- 1:115.4.3+build1-0ubuntu1
- 1:115.5.0+build1-0ubuntu1
- 1:115.5.1+build1-0ubuntu1
- 1:115.5.2+build2-0ubuntu1
- 1:115.6.0+build1-0ubuntu1
- 1:115.6.0+build2-0ubuntu1
- 1:115.6.1+build1-0ubuntu1
- 1:115.8.0+build1-0ubuntu1
- 1:115.8.1+build1+snap2
- 1:115.8.1+build1+snap3
- 2:1snap1-0ubuntu1
- 2:1snap1-0ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
thunderbird Ubuntu:25.10
- Versions
- 2:1snap1-0ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published