There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.
References
Configurations
History
13 Feb 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. |
21 Nov 2024, 07:40
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://chromium.googlesource.com/webm/libwebp - Product | |
| References | () https://security.gentoo.org/glsa/202309-05 - | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
05 Jul 2023, 12:47
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-20 12:15
Updated : 2025-02-13 17:16
NVD link : CVE-2023-1999
Mitre link : CVE-2023-1999
CVE.ORG link : CVE-2023-1999
JSON object : View
Products Affected
webmproject
- libwebp