Vulnerability · Published Jun 20, 2023 · Assigned by Google
CVE-2023-1999Use after free in libwebp
Medium 5.3
In plain English
A medium-severity use-after-free in libwebp from Chromium. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 61% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libwebp | 1.0.0-8.el8_7 | ALSA-2023:2076 |
| AlmaLinux:9 | libwebp | 1.2.0-6.el9_1 | ALSA-2023:2078 |
| AlmaLinux:8 | libwebp-devel | 1.0.0-8.el8_7 | ALSA-2023:2076 |
| AlmaLinux:9 | libwebp-devel | 1.2.0-6.el9_1 | ALSA-2023:2078 |
| Alpine:v3.20 | firefox-esr | 102.10.0-r0 | ALPINE-CVE-2023-1999 |
| Alpine:v3.21 | firefox-esr | 102.10.0-r0 | ALPINE-CVE-2023-1999 |
| Alpine:v3.22 | firefox-esr | 102.10.0-r0 | ALPINE-CVE-2023-1999 |
| Alpine:v3.23 | firefox-esr | 102.10.0-r0 | ALPINE-CVE-2023-1999 |
| Alpine:v3.20 | libwebp | 1.3.0-r3 | ALPINE-CVE-2023-1999 |
| Alpine:v3.21 | libwebp | 1.3.0-r3 | ALPINE-CVE-2023-1999 |
| Alpine:v3.22 | libwebp | 1.3.0-r3 | ALPINE-CVE-2023-1999 |
| Alpine:v3.23 | libwebp | 1.3.0-r3 | ALPINE-CVE-2023-1999 |
| Alpine:v3.24 | libwebp | 1.3.0-r3 | ALPINE-CVE-2023-1999 |
| Debian:12 | firefox-esr | 102.10.0esr-1 | DEBIAN-CVE-2023-1999 |
| Debian:13 | firefox-esr | 102.10.0esr-1 | DEBIAN-CVE-2023-1999 |
| Debian:14 | firefox-esr | 102.10.0esr-1 | DEBIAN-CVE-2023-1999 |
| Debian:12 | libwebp | 1.2.4-0.2 | DEBIAN-CVE-2023-1999 |
| Debian:13 | libwebp | 1.2.4-0.2 | DEBIAN-CVE-2023-1999 |
| Debian:14 | libwebp | 1.2.4-0.2 | DEBIAN-CVE-2023-1999 |
| Debian:12 | thunderbird | 1:102.10.0-1 | DEBIAN-CVE-2023-1999 |
| Debian:13 | thunderbird | 1:102.10.0-1 | DEBIAN-CVE-2023-1999 |
| Debian:14 | thunderbird | 1:102.10.0-1 | DEBIAN-CVE-2023-1999 |
| Rocky Linux:8 | libwebp | 0:1.0.0-8.el8_7 | RLSA-2023:2076 |
| Rocky Linux:9 | libwebp | 0:1.2.0-6.el9_1 | RLSA-2023:2078 |
| Rocky Linux:9 | libwebp | 0:1.2.0-6.el9_1.0.1 | RLSA-2023:2078 |
| Ubuntu:22.04:LTS | libwebp | 1.2.2-2ubuntu0.22.04.1 | USN-6078-1 |
| Ubuntu:22.04:LTS | libwebp | 1.2.2-2ubuntu0.22.04.1 | UBUNTU-CVE-2023-1999 |
| Ubuntu:22.04:LTS | mozjs78 | no fix listed | UBUNTU-CVE-2023-1999 |
| Ubuntu:22.04:LTS | mozjs91 | no fix listed | UBUNTU-CVE-2023-1999 |
| Ubuntu:22.04:LTS | thunderbird | no fix listed | UBUNTU-CVE-2023-1999 |
| Ubuntu:24.04:LTS | thunderbird | no fix listed | UBUNTU-CVE-2023-1999 |
| Ubuntu:25.10 | thunderbird | no fix listed | UBUNTU-CVE-2023-1999 |
| Ubuntu:26.04:LTS | thunderbird | no fix listed | UBUNTU-CVE-2023-1999 |
| Ubuntu:26.10 | thunderbird | no fix listed | UBUNTU-CVE-2023-1999 |
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N