libwebp: CVE-2023-1999

Debian Bug report logs - #1035371
libwebp: CVE-2023-1999

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libwebp: CVE-2023-1999

Date: Tue, 02 May 2023 10:13:23 +0200

Source: libwebp
Version: 1.2.4-0.1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for libwebp.

There is unfortunately no public reference accessible, [1] has no
details, [2] is restricted. it might be related to [3] and [4].

CVE-2023-1999[0]:
| Double-free in libwebp

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-1999
    https://www.cve.org/CVERecord?id=CVE-2023-1999
[1] https://www.mozilla.org/en-US/security/advisories/mfsa2023-13/#CVE-2023-1999
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=1819244
[3] https://bugs.chromium.org/p/webp/issues/detail?id=603
[4] https://chromium.googlesource.com/webm/libwebp/+/a486d800b60d0af4cc0836bf7ed8f21e12974129

Can you find more on the issue?

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Send a report that this bug log contains spam.