CVE-2023-1999 — Use After Free in Libwebp

CWE-416 — Use After FreeCWE-415 — Double Free14 documents11 sources
Severity
7.5HIGHNVD
CNA5.3
EPSS
0.4%
top 41.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Chromium LibwebpMozilla ThunderbirdWebmproject Libwebp
Timeline
PublishedJun 20
Latest updateSep 12

Description

There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5chromium/libwebp0.4.2 — 1.3.1+1
▶NVDwebmproject/libwebp0.4.2 — 1.3.1
▶Debianwebmproject/libwebp< 0.6.1-2.1+deb11u1+3
▶Debianmozilla/thunderbird< 1:102.10.0-1~deb11u1+3

🔴Vulnerability Details

3
GHSA
GHSA-8x9p-cw2c-6253: There exists a use after free/double free in libwebp↗2023-06-20
▶
OSV
CVE-2023-1999: There exists a use after free/double free in libwebp↗2023-06-20
▶
CVEList
Use after free in libwebp↗2023-06-20
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft IIS 1.0 / Netscape Server 1.0/1.12 / OReilly WebSite Professional 1.1b - '.cmd' / '.CMD' Remote Command Execution↗1996-03-01
▶

📋Vendor Advisories

9
Microsoft
Chromium: CVE-2023-1999 Use after free in libwebp↗2023-09-12
▶
Ubuntu
libwebp vulnerability↗2023-07-18
▶
Oracle
Oracle Oracle Communications Risk Matrix: Virtual Network Function Manager (Libwebp) — CVE-2023-1999↗2023-07-15
▶
Ubuntu
libwebp vulnerability↗2023-05-16
▶
Red Hat
Mozilla: libwebp: Double-free in libwebp↗2023-04-11
▶
CVE-2023-1999 — Use After Free in Chromium Libwebp | cvebase