DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Red Hat Enterprise Linux (libwebp): Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2021-11-09
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux libwebp ausnutzen, um Informationen offenzulegen, einen Denial of Service zu verursachen oder Sicherheitsvorkehrungen zu umgehen.
01
beschreibt (8)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-36332US | high7.5 | — | ||
A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threat from this vulnerability is to the serv… | ||||
| CVE-2020-36331US | critical9.1 | — | ||
A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability is to data confidentia… | ||||
| CVE-2020-36330US | critical9.1 | — | ||
A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confid… | ||||
| CVE-2018-25014US | critical9.8 | — | ||
A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol(). | ||||
| CVE-2018-25013US | critical9.1 | — | ||
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes(). | ||||
| CVE-2018-25012US | critical9.1 | — | ||
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24(). | ||||
| CVE-2018-25010US | critical9.1 | — | ||
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter(). | ||||
| CVE-2018-25009US | critical9.1 | — | ||
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16(). | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- RedHat Security Advisory vom 2021-11-09external
- Amazon Linux Security Advisory ALAS-2023-2031 vom 2023-05-03external
- Amazon Linux Security Advisory ALAS-2023-2048 vom 2023-05-17external
- Amazon Linux Security Advisory ALAS-2023-1748 vom 2023-05-24external
- WID-SEC-W-2023-1123 - CSAF Versionself
- WID-SEC-2023-1123 - Portal Versionself
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan