[CLSA-2023:1696537325] Fix of 10 CVEs
Type:
security
Severity:
Critical
Release date:
2023-10-05 20:22:09 UTC
Description:
* SECURITY UPDATE: a heap-based buffer overflow - debian/patches/CVE-2018-25009.patch: add additional check to avoid read over the header - CVE-2018-25009 * SECURITY UPDATE: a heap-based buffer overflow - debian/patches/CVE-2018-25010.patch: limit the filter size to not exceed the image dimensions - CVE-2018-25010 * SECURITY UPDATE: fail on multiple image chunks - debian/patches/CVE-2018-25011.patch: only 1 image chunk allowed - CVE-2018-25011 * SECURITY UPDATE: a heap-based buffer overflow - debian/patches/CVE-2018-25013_4.patch: wait for all threads to be done in DecodeRemaining. - CVE-2018-25013 - CVE-2018-25014 * SECURITY UPDATE: a heap-based buffer overflow - debian/patches/CVE-2020-36328.patch: fix invalid check for buffer size - CVE-2020-36328 * SECURITY UPDATE: a use-after-free was found due to a thread being killed too early - debian/patches/CVE-2020-36329.patch: fix for thread race heap-use-after-free - CVE-2020-36329 * SECURITY UPDATE: an out-of-bounds read - debian/patches/CVE-2020-36330.patch: fix riff size checks - CVE-2020-36330 * SECURITY UPDATE: an out-of-bounds read - debian/patches/CVE-2020-36331.patch: validate chunk_size - CVE-2020-36331 * SECURITY UPDATE: a use after free/double free - debian/patches/CVE-2023-1999.patch: clear result->bw on error - CVE-2023-1999
Updated packages:
  • libwebp-dev_0.4.4-1+tuxcare.els1_amd64.deb
    sha:f11e54351a91196aa7cfe63c185ce270b334899f
  • libwebp5_0.4.4-1+tuxcare.els1_amd64.deb
    sha:ebd1bac6bda9ad60f4d42820cf1baedb0adc1536
  • libwebpdemux1_0.4.4-1+tuxcare.els1_amd64.deb
    sha:b25b7b5e863eb32b51ce666c4e9b2fa810f86cd5
  • libwebpmux1_0.4.4-1+tuxcare.els1_amd64.deb
    sha:4b479d1a23c33e47c185597ee5377c9972967d41
  • webp_0.4.4-1+tuxcare.els1_amd64.deb
    sha:1e93c4bff575fac0c003835524eba626c5895325
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.