[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ZRKn0bQVe4MBMYiC@eldamar.lan>
Date: Tue, 26 Sep 2023 11:43:45 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2023-4863: libwebp: Heap buffer overflow in
WebP Codec
Hi,
On Thu, Sep 21, 2023 at 10:52:50PM +0200, Solar Designer wrote:
> Hi,
>
> Ideally this should have been brought in here ~10 days ago, but I guess
> better late than never, and I'd like to encourage others to be bringing
> relevant stuff to the list.
>
> On September 11, Google announced an update to Chrome:
>
> https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
>
> fixing this issue:
>
> > Critical CVE-2023-4863: Heap buffer overflow in WebP. Reported by Apple
> > Security Engineering and Architecture (SEAR) and The Citizen Lab at The
> > University of Toronto's Munk School on 2023-09-06
> >
> > We would also like to thank all security researchers that worked with us
> > during the development cycle to prevent security bugs from ever reaching
> > the stable channel.
> >
> > Google is aware that an exploit for CVE-2023-4863 exists in the wild.
>
> With the bug being in a library used by many projects, this made people
> wonder why a CVE was assigned to Chrome rather than to libwebp:
>
> https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
Maybe related to this question in todays CVEs updates there appeared
https://www.cve.org/CVERecord?id=CVE-2023-5129
vs.
https://www.cve.org/CVERecord?id=CVE-2023-4863
FWIW, I contacted the assigning CNAs so this can be clarified (e.g. if
one of those needs to be rejected).
Regards,
Salvatore
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
