CVE-2020-36330
published 2021-05-21CVE-2020-36330: A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this…
PriorityP350critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
2.23%
80.9th percentile
A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the service availability.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_14.7_and_ipados | — | — |
| apple | ipados | < 14.7 | 14.7 |
| apple | iphone_os | < 14.7 | 14.7 |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libwebp | < libwebp 0.6.1-2.1 (bookworm) | libwebp 0.6.1-2.1 (bookworm) |
| msrc | cm1_libwebp_1.0.3-1_on_cbl_mariner_1.0 | — | — |
| paloalto | pan-os | — | — |
| redhat | enterprise_linux | — | — |
| webmproject | libwebp | < 1.0.1 | 1.0.1 |
| webmproject | libwebp | — | — |
| webmproject | libwebp | >= 0 < 0.6.1-2.1 | 0.6.1-2.1 |
| webmproject | libwebp | >= 0 < 0.6.1-2.1 | 0.6.1-2.1 |
| webmproject | libwebp | >= 0 < 0.6.1-2.1 | 0.6.1-2.1 |
| webmproject | libwebp | >= 0 < 0.6.1-2.1 | 0.6.1-2.1 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
osv9.1CRITICAL
vendor_debian9.1CRITICAL
vendor_msrc9.1CRITICAL
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
vendor_paloalto·2024-04-10·CVSS 9.8
CVE-2015-5739 [CRITICAL] PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS. While it was not determined that these CVEs have any significant impact on PAN-OS, they have been fixed out of an abundance of caution. CVE Summary CVE-2015-5739 This CVE is fixed in PAN-OS 11.0.4, and all later PAN-OS versions. CVE-2016-10228 This CVE is fixed in PAN-OS 11.1.3, and all later PAN-OS versions. CVE-2017-8923 This CVE is fixed in PAN-OS 10.2.8, 11.0.3, and all later PAN-OS versions. CVE-2017-9120 This CVE is fixed in PAN-OS 10.2.8, 11.0.3, and all later PAN-OS versions. CVE-2018-25009 This CVE is fixed in PAN-OS 10.2.8, 11.0.4, 11.1.3, and all later PAN-OS versions. CVE-2
Ubuntu
libwebp vulnerabilities
vendor_ubuntu·2021-06-10
CVE-2020-36331 libwebp vulnerabilities
Title: libwebp vulnerabilities
Summary: libwebp could be made to crash or run programs as your login if it
opened a specially crafted file.
USN-4971-1 fixed several vulnerabilities in libwebp. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that libwebp incorrectly handled certain malformed
images. If a user or automated system were tricked into opening a specially
crafted image file, a remote attacker could use this issue to cause libwebp
to crash, resulting in a denial of service, or possibly execute arbitrary
code.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
libwebp vulnerabilities
vendor_ubuntu·2021-06-01
CVE-2020-36331 libwebp vulnerabilities
Title: libwebp vulnerabilities
Summary: libwebp could be made to crash or run programs as your login if it
opened a specially crafted file.
It was discovered that libwebp incorrectly handled certain malformed
images. If a user or automated system were tricked into opening a specially
crafted image file, a remote attacker could use this issue to cause libwebp
to crash, resulting in a denial of service, or possibly execute arbitrary
code.
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the
vendor_msrc·2021-05-11·CVSS 9.1
CVE-2020-36330 [CRITICAL] CWE-125 A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the
A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the service availability.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identifi
Red Hat
libwebp: out-of-bounds read in ChunkVerifyAndAssign() in mux/muxread.c
vendor_redhat·2020-02-25·CVSS 9.1
CVE-2020-36330 [CRITICAL] CWE-125 libwebp: out-of-bounds read in ChunkVerifyAndAssign() in mux/muxread.c
libwebp: out-of-bounds read in ChunkVerifyAndAssign() in mux/muxread.c
A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the service availability.
A flaw was found in libwebp. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the service availability.
Statement: This issue did not affect the versions of Firefox and Thunderbird as shipped with Red Hat Enterprise Linux 7, and 8 as they embed the fixed version of libwebp.
Package: firefox (Red Hat Enterprise Linux 7) - Out of support scope
Package: libwebp (Red Hat Enterprise Linux 7) - Out of support
Debian
CVE-2020-36330: libwebp - A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was ...
vendor_debian·2020·CVSS 9.1
CVE-2020-36330 [CRITICAL] CVE-2020-36330: libwebp - A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was ...
A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the service availability.
Scope: local
bookworm: resolved (fixed in 0.6.1-2.1)
bullseye: resolved (fixed in 0.6.1-2.1)
forky: resolved (fixed in 0.6.1-2.1)
sid: resolved (fixed in 0.6.1-2.1)
trixie: resolved (fixed in 0.6.1-2.1)
Apple
CVE-2020-36330: iOS 14.7 and iPadOS 14.7
vendor_apple·CVSS 9.1
CVE-2020-36330 [CRITICAL] CVE-2020-36330: iOS 14.7 and iPadOS 14.7
Apple Security Update: About the security content of iOS 14.7 and iPadOS 14.7
Product: iOS 14.7 and iPadOS
Version: 14.7
CVE: CVE-2020-36330
Component: CVE-2020-36330
GHSA
GHSA-478j-8hp8-fjpw: A flaw was found in libwebp in versions before 1
ghsa_unreviewed·2022-05-24
CVE-2020-36330 [CRITICAL] CWE-125 GHSA-478j-8hp8-fjpw: A flaw was found in libwebp in versions before 1
A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the service availability.
OSV
CVE-2020-36330: A flaw was found in libwebp in versions before 1
osv·2021-05-21·CVSS 9.1
CVE-2020-36330 [CRITICAL] CVE-2020-36330: A flaw was found in libwebp in versions before 1
A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the service availability.
No detection rules found.
No public exploits indexed.
Qualys
iOS and iPadOS 14.7 and 14.7.1 Security Update: Discover Vulnerabilities and Take Remote Response Action Using VMDR for Mobile Devices | Qualys
blogs_qualys·2021-07-28·CVSS 7.8
[HIGH] iOS and iPadOS 14.7 and 14.7.1 Security Update: Discover Vulnerabilities and Take Remote Response Action Using VMDR for Mobile Devices | Qualys
Apple recently released iOS and iPadOS 14.7 and 14.7.1 which include a security update that addresses almost 38 vulnerabilities, among them several critical RCE and privilege escalation vulnerabilities. Qualys recommends that security teams should immediately update all devices running iOS and iPadOS to the latest version.
The vulnerabilities affect iOS and iPadOS components including ImageIO, Kernel, Preferences, Model I/O, Image Processing, WebKit, FontParser, and others. Apple has for the third time released a minor release (14.7.1) after a major release (14.7) to fix a critical vulnerability (CVE-2021-30807) that has been actively exploited. Successful exploitation of the vulnerability allows an application to execute arbitrary code with kernel privileges. Spyware like Pegasus might e
Qualys
iOS and iPadOS 14.7 and 14.7.1 Security Update: Discover Vulnerabilities and Take Remote Response Action Using VMDR for Mobile Devices
blogs_qualys·2021-07-28·CVSS 7.8
[HIGH] iOS and iPadOS 14.7 and 14.7.1 Security Update: Discover Vulnerabilities and Take Remote Response Action Using VMDR for Mobile Devices
Apple recently released iOS and iPadOS 14.7 and 14.7.1 which include a security update that addresses almost 38 vulnerabilities, among them several critical RCE and privilege escalation vulnerabilities. Qualys recommends that security teams should immediately update all devices running iOS and iPadOS to the latest version.
The vulnerabilities affect iOS and iPadOS components including ImageIO, Kernel, Preferences, Model I/O, Image Processing, WebKit, FontParser, and others. Apple has for the third time released a minor release (14.7.1) after a major release (14.7) to fix a critical vulnerability (CVE-2021-30807) that has been actively exploited. Successful exploitation of the vulnerability allows an application to execute arbitrary code with kernel privileges. Spyware like Pegasus might e
http://seclists.org/fulldisclosure/2021/Jul/54https://bugzilla.redhat.com/show_bug.cgi?id=1956853https://lists.debian.org/debian-lts-announce/2021/06/msg00005.htmlhttps://lists.debian.org/debian-lts-announce/2021/06/msg00006.htmlhttps://security.netapp.com/advisory/ntap-20211104-0004/https://support.apple.com/kb/HT212601https://www.debian.org/security/2021/dsa-4930http://seclists.org/fulldisclosure/2021/Jul/54https://bugzilla.redhat.com/show_bug.cgi?id=1956853https://lists.debian.org/debian-lts-announce/2021/06/msg00005.htmlhttps://lists.debian.org/debian-lts-announce/2021/06/msg00006.htmlhttps://security.netapp.com/advisory/ntap-20211104-0004/https://support.apple.com/kb/HT212601https://www.debian.org/security/2021/dsa-4930
2021-05-21
Published