CVE-2023-5129
published 2023-09-25CVE-2023-5129: With a specially crafted WebP lossless file, libwebp may write data out of bounds to the heap. The ReadHuffmanCodes() function allocates the HuffmanCode buffer…
high8.8
ITW
Exploited in the wild
With a specially crafted WebP lossless file, libwebp may write data out of bounds to the heap.
The ReadHuffmanCodes() function allocates the HuffmanCode buffer with a size that comes from an array of precomputed sizes: kTableSize. The color_cache_bits value defines which size to use.
The kTableSize array only takes into account sizes for 8-bit first-level table lookups but not second-level table lookups. libwebp allows codes that are up to 15-bit (MAX_ALLOWED_CODE_LENGTH). When BuildHuffmanTable() attempts to fill the second-level tables it may write data out-of-bounds. The OOB write to the undersized array happens in ReplicateValue.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | guacamole | — | — |
| electron | electron | >= 22.0.0 < 22.3.24 | 22.3.24 |
| electron | electron | >= 24.0.0 < 24.8.3 | 24.8.3 |
| electron | electron | >= 25.0.0 < 25.8.1 | 25.8.1 |
| electron | electron | >= 26.0.0 < 26.2.1 | 26.2.1 |
| electron | electron | >= 27.0.0-beta.1 < 27.0.0-beta.2 | 27.0.0-beta.2 |
| github.com | chai2010_webp | >= 0 < 0.0.0-20250406010349-76805d5a8860 | 0.0.0-20250406010349-76805d5a8860 |
| github.com | chai2010_webp | >= 0.0.0 < 1.1.2-0.20250406010349-76805d5a8860 | 1.1.2-0.20250406010349-76805d5a8860 |
| github.com | chai2010_webp | >= 1.1.2 < 1.4.0 | 1.4.0 |
| microsoft | webp_image_extension | >= 0 < 0.2.6 | 0.2.6 |
| mozilla | firefox | — | — |
| platform | external_webp | >= 11:0 < 11:2023-10-06 | 11:2023-10-06 |
| platform | external_webp | >= 12:0 < 12:2023-10-06 | 12:2023-10-06 |
| platform | external_webp | >= 12L:0 < 12L:2023-10-06 | 12L:2023-10-06 |
| platform | external_webp | >= 13:0 < 13:2023-10-06 | 13:2023-10-06 |
| platform | external_webp | >= 14-next:0 < 14-next:2023-10-06 | 14-next:2023-10-06 |
| python | pillow | >= 0 < 10.0.1 | 10.0.1 |
CVSS provenance
ghsa8.8HIGH
osv8.8HIGH
vendor_apache8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Duplicate Advisory: Bundled libwebp in Pillow vulnerable
osv·2023-10-05·CVSS 8.8
CVE-2023-5129 [HIGH] Duplicate Advisory: Bundled libwebp in Pillow vulnerable
Duplicate Advisory: Bundled libwebp in Pillow vulnerable
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-56pw-mpj4-fxww. This link is maintained to preserve external references.
## Original Description
Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.
GHSA
Bundled libwebp in imagecodecs vulnerable
ghsa·2023-10-05·CVSS 8.8
CVE-2023-5129 [HIGH] Bundled libwebp in imagecodecs vulnerable
Bundled libwebp in imagecodecs vulnerable
imagecodecs versions before v2023.9.18 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). imagecodecs v2023.9.18 upgrades the bundled libwebp binary to v1.3.2.
GHSA
Duplicate Advisory: Bundled libwebp in Pillow vulnerable
ghsa·2023-10-05·CVSS 8.8
CVE-2023-5129 [HIGH] Duplicate Advisory: Bundled libwebp in Pillow vulnerable
Duplicate Advisory: Bundled libwebp in Pillow vulnerable
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-56pw-mpj4-fxww. This link is maintained to preserve external references.
## Original Description
Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.
OSV
Bundled libwebp in imagecodecs vulnerable
osv·2023-10-05·CVSS 8.8
CVE-2023-5129 [HIGH] Bundled libwebp in imagecodecs vulnerable
Bundled libwebp in imagecodecs vulnerable
imagecodecs versions before v2023.9.18 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). imagecodecs v2023.9.18 upgrades the bundled libwebp binary to v1.3.2.
OSV
CVE-2023-4863: In BuildHuffmanTable of huffman_utils
osv·2023-10-01
CVE-2023-4863 CVE-2023-4863: In BuildHuffmanTable of huffman_utils
In BuildHuffmanTable of huffman_utils.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
GHSA
GHSA-hhrh-69hc-fgg7: With a specially crafted WebP lossless file, libwebp may write data out of bounds to the heap
ghsa_unreviewed·2023-09-25
CVE-2023-5129 CWE-20 GHSA-hhrh-69hc-fgg7: With a specially crafted WebP lossless file, libwebp may write data out of bounds to the heap
With a specially crafted WebP lossless file, libwebp may write data out of bounds to the heap.
The ReadHuffmanCodes() function allocates the HuffmanCode buffer with a size that comes from an array of precomputed sizes: kTableSize. The color_cache_bits value defines which size to use.
The kTableSize array only takes into account sizes for 8-bit first-level table lookups but not second-level table lookups. libwebp allows codes that are up to 15-bit (MAX_ALLOWED_CODE_LENGTH). When BuildHuffmanTable() attempts to fill the second-level tables it may write data out-of-bounds. The OOB write to the undersized array happens in ReplicateValue.
OSV
CVE-2023-5129: imagecodecs versions before v2023
osv·2023-09-20·CVSS 8.8
CVE-2023-5129 [HIGH] CVE-2023-5129: imagecodecs versions before v2023
imagecodecs versions before v2023.9.18 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). imagecodecs v2023.9.18 upgrades the bundled libwebp binary to v1.3.2.
OSV
CVE-2023-5129: Pillow versions before v10
osv·2023-09-20·CVSS 8.8
CVE-2023-5129 [HIGH] CVE-2023-5129: Pillow versions before v10
Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.
OSV
libwebp: OOB write in BuildHuffmanTable
osv·2023-09-12
CVE-2023-4863 [HIGH] libwebp: OOB write in BuildHuffmanTable
libwebp: OOB write in BuildHuffmanTable
Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.
OSV
libwebp: OOB write in BuildHuffmanTable
osv·2023-09-12
CVE-2023-4863 libwebp: OOB write in BuildHuffmanTable
libwebp: OOB write in BuildHuffmanTable
[Google](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html) and [Mozilla](https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/) have released security advisories for RCE due to heap overflow in libwebp. Google warns the vulnerability has been exploited in the wild.
libwebp needs to be updated to 1.3.2 to include a patch for "OOB write in BuildHuffmanTable".
Red Hat
libwebp: out-of-bounds write with a specially crafted WebP lossless file
vendor_redhat·2023-09-25·CVSS 8.8
CVE-2023-5129 [HIGH] CWE-122 libwebp: out-of-bounds write with a specially crafted WebP lossless file
libwebp: out-of-bounds write with a specially crafted WebP lossless file
This CVE ID has been rejected by its CVE Numbering Authority. Duplicate of CVE-2023-4863.
Statement: This flaw was found to be a duplicate of CVE-2023-4863. Please see https://access.redhat.com/security/cve/CVE-2023-4863 for information about affected products and security errata.
Package: firefox (Red Hat Enterprise Linux 6) - Out of support scope
Package: libwebp (Red Hat Enterprise Linux 7) - Not affected
Package: firefox:flatpak/firefox (Red Hat Enterprise Linux 9) - Affected
Package: thunderbird:flatpak/thunderbird (Red Hat Enterprise Linux 9) - Affected
Mozilla
Mozilla Foundation Security Advisory 2023-40: CVE-2023-5129
vendor_mozilla·CVSS 8.8
CVE-2023-5129 [HIGH] Mozilla Foundation Security Advisory 2023-40: CVE-2023-5129
Mozilla Foundation Security Advisory 2023-40
CVE: CVE-2023-5129
Product: Firefox, Firefox ESR, Thunderbird
Impact: critical
Fixed in: Firefox 117.0.1
Firefox ESR 102.15.1
Firefox ESR 115.2.1
Thunderbird 102.15.1
Thunderbird 115.2.2
Apache
Apache guacamole: CVE-2023-5129
vendor_apache·CVSS 8.8
CVE-2023-5129 [HIGH] Apache guacamole: CVE-2023-5129
Apache guacamole: CVE-2023-5129
No. CVE-2023-5129 (aka CVE-2023-4863) deals specifically with decoding WebP images, not encoding. You would also receive updates to libwebp from your distribution as the library itself is not bundled within Guacamole. If using our Docker images, the images are automatically rebuilt nightly to bring in updates from the maintainer of the base image (Alpine Linux), and a pull of the latest would give you an updated image.
No detection rules found.
No public exploits indexed.
Wiz
Crying out Cloud – Our Favorite Stories of 2023 | Wiz Blog
blogs_wiz·2024-01-16·CVSS 7.8
[HIGH] Crying out Cloud – Our Favorite Stories of 2023 | Wiz Blog
2023 certainly had its share of tumultuous events that shaped the perceptions of cloud customers everywhere — there were supply chain attacks, critical 0day vulnerabilities and advancements in both AI and AI security that all left their mark on how we approach cloud security. As the year came to a close, the Crying out Cloud team (Eden, Merav and Amitai) sat down to discuss what we felt were our most interesting podcast episodes and newsletter editions of 2023.
# High Profile Vulnerabilities
## Merav’s picks
### Chrome vulnerabilities that weren’t actually Chrome vulnerabilities
(from our newsletter)
Several critical vulnerabilities in Google Chrome were published in 2023. In a few cases, items that fell into the Chrome category were hiding much more interesting vulnerabilities. CVE-2
Wiz
Crying out Cloud – Our Favorite Stories of 2023 | Wiz Blog
blogs_wiz·2024-01-16·CVSS 7.8
[HIGH] Crying out Cloud – Our Favorite Stories of 2023 | Wiz Blog
2023 certainly had its share of tumultuous events that shaped the perceptions of cloud customers everywhere — there were supply chain attacks, critical 0day vulnerabilities and advancements in both AI and AI security that all left their mark on how we approach cloud security. As the year came to a close, the Crying out Cloud team ( Eden , Merav and Amitai ) sat down to discuss what we felt were our most interesting podcast episodes and newsletter editions of 2023.
## High Profile Vulnerabilities
## Merav’s picks
## Chrome vulnerabilities that weren’t actually Chrome vulnerabilities
(from our newsletter )
Several critical vulnerabilities in Google Chrome were published in 2023. In a few cases, items that fell into the Chrome category were hiding much more interesting vulnerabilities .
Bleepingcomputer
Microsoft Edge, Teams get fixes for zero-days in open-source libraries
blogs_bleepingcomputer·2023-10-03·CVSS 8.8
[HIGH] Microsoft Edge, Teams get fixes for zero-days in open-source libraries
## Microsoft Edge, Teams get fixes for zero-days in open-source libraries
## Sergiu Gatlan
The libwebp library is used by a large number of projects for encoding and decoding images in the WebP format, including modern web browsers like Safari, Mozilla Firefox , Microsoft Edge, Opera, and the native Android web browsers, as well as popular apps like 1Password and Signal .
libvpx is used for VP8 and VP9 video encoding and decoding by desktop video player software and online streaming services like Netflix, YouTube, and Amazon Prime Video.
"Microsoft is aware and has released patches associated with the two Open-Source Software security vulnerabilities, CVE-2023-4863 and CVE-2023-5217," Redmond revealed in a Microsoft Security Response Center advisory published Monday.
The two security
Wiz
CVE-2023-4863 and CVE-2023-5217 Exploited in the Wild | Wiz Blog
blogs_wiz·2023-10-01·CVSS 7.8
CVE-2023-4863 [HIGH] CVE-2023-4863 and CVE-2023-5217 Exploited in the Wild | Wiz Blog
CVE-2023-4863 is a critical vulnerability in libwebp, and CVE-2023-5217 is a high severity vulnerability in libvpx, both reportedly exploited in the wild. Both are mainly client side vulnerabilities and thus unlikely to be exploitable on most affected cloud workloads other than virtual desktops and servers that handle images or video. Customers should therefore prioritize patching these cases as well as vulnerable instances detected in build environments.
## What is CVE-2023-4863?
## Background
On September 11th, 2023, a vulnerability was assigned CVE-2023-4863 that reportedly only affected Chrome. More specifically, it was described as a heap buffer overflow in WebP in Chrome, allowing a remote attacker to perform an out of bounds memory write via a crafted HTML page.
However, further
Wiz
CVE-2023-4863 and CVE-2023-5217 Exploited in the Wild | Wiz Blog
blogs_wiz·2023-10-01·CVSS 7.8
CVE-2023-4863 [HIGH] CVE-2023-4863 and CVE-2023-5217 Exploited in the Wild | Wiz Blog
CVE-2023-4863 is a critical vulnerability in libwebp, and CVE-2023-5217 is a high severity vulnerability in libvpx, both reportedly exploited in the wild. Both are mainly client side vulnerabilities and thus unlikely to be exploitable on most affected cloud workloads other than virtual desktops and servers that handle images or video. Customers should therefore prioritize patching these cases as well as vulnerable instances detected in build environments.
# What is CVE-2023-4863?
## Background
On September 11th, 2023, a vulnerability was assigned CVE-2023-4863 that reportedly only affected Chrome. More specifically, it was described as a heap buffer overflow in WebP in Chrome, allowing a remote attacker to perform an out of bounds memory write via a crafted HTML page.
However, further
Talos
The security pitfalls of social media sites offering ID-based authentication
blogs_talos·2023-09-28
The security pitfalls of social media sites offering ID-based authentication
## The security pitfalls of social media sites offering ID-based authentication
Welcome to this week’s edition of the Threat Source newsletter.
Since Elon Musk first started talking about purchasing Twitter/X around this time last year, one of his main sticking points has been how many bot accounts are on the platform and how that potentially affects advertising revenue and user counts.
In the latest advancement in the alleged fight against bots, X recently launched a government ID-based authentication process available to its paid premium users. The social media platform is partnering with a third-party security company to provide advanced, faster support to make it more difficult for others to impersonate the user .
The setup process says it involves the user taking a picture with th
Talos
The security pitfalls of social media sites offering ID-based authentication
blogs_talos·2023-09-28
The security pitfalls of social media sites offering ID-based authentication
Welcome to this week’s edition of the Threat Source newsletter.
Since Elon Musk first started talking about purchasing Twitter/X around this time last year, one of his main sticking points has been how many bot accounts are on the platform and how that potentially affects advertising revenue and user counts.
In the latest advancement in the alleged fight against bots, X recently launched a government ID-based authentication process available to its paid premium users. The social media platform is partnering with a third-party security company to provide advanced, faster support to make it more difficult for others to impersonate the user.
The setup process says it involves the user taking a picture with their computer’s camera with their government-issued ID. According to X’s Verificati
Huntress
Critical Vulnerability: WebP Heap Buffer Overflow (CVE-2023-4863) | Huntress
blogs_huntress·2023-09-28·CVSS 8.8
CVE-2023-4863 [HIGH] Critical Vulnerability: WebP Heap Buffer Overflow (CVE-2023-4863) | Huntress
The Huntress team is currently investigating CVE-2023-4863 , a heap buffer overflow in the WebP image encoding/decoding (codec) library (libwebp). Threat actors are exploiting this critical vulnerability in the wild, which affects anything using the libwebp library version prior to 1.3.2.
This is a rapidly evolving situation, and we will update this blog post with information we receive and confirm—but here’s everything we know so far:
## What’s Happening?
WebP is a common image format that supports lossless and lossy compression for web-based images. It is similar to the JPG, PNG, and SVG formats and is natively supported by most common web browsers like Google Chrome, Safari, Firefox, and Edge.
The attack is accomplished by presenting a crafted WebP lossless file to software using li
Bleepingcomputer
Google fixes fifth actively exploited Chrome zero-day of 2023
blogs_bleepingcomputer·2023-09-27·CVSS 8.8
CVE-2023-5217 [HIGH] Google fixes fifth actively exploited Chrome zero-day of 2023
## Google fixes fifth actively exploited Chrome zero-day of 2023
## Sergiu Gatlan
While the advisory says it will likely take days or weeks until the patched version reaches the entire user base, the update was immediately available when BleepingComputer checked for updates.
The web browser will also auto-check for new updates and automatically install them after the next launch.
## Exploited in spyware attacks
The high-severity zero-day vulnerability ( CVE-2023-5217 ) is caused by a heap buffer overflow weakness in the VP8 encoding of the open-source libvpx video codec library, a flaw whose impact ranges from app crashes to arbitrary code execution.
The bug was reported by Google Threat Analysis Group (TAG) security researcher Clément Lecigne on Monday, September 25.
Google TAG res
Tenable
CVE-2023-41064, CVE-2023-4863, CVE-2023-5129: Frequently Asked Questions for ImageIO and WebP/libwebp Zero-Day Vulnerabilities
blogs_tenable·2023-09-27·CVSS 7.8
[HIGH] CVE-2023-41064, CVE-2023-4863, CVE-2023-5129: Frequently Asked Questions for ImageIO and WebP/libwebp Zero-Day Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
Google assigns new maximum rated CVE to libwebp bug exploited in attacks
blogs_bleepingcomputer·2023-09-26·CVSS 7.8
[HIGH] Google assigns new maximum rated CVE to libwebp bug exploited in attacks
## Google assigns new maximum rated CVE to libwebp bug exploited in attacks
## Sergiu Gatlan
Security researchers at Citizen Lab have an established track record of detecting and revealing zero-days that have been abused in targeted spyware campaigns, often linked to state-sponsored threat actors primarily targeting high-risk individuals such as journalists and opposition politicians.
The decision to tag it as a Chrome bug caused confusion within the cybersecurity community, prompting questions regarding Google's choice to categorize it as a Google Chrome issue rather than identifying it as a flaw in libwebp.
Security consulting firm founder Ben Hawkes (who previously led Google's Project Zero team) also linked CVE-2023-4863 to the CVE-2023-41064 vulnerability addressed by Apple on Sep
Huntress
Critical Vulnerability: WebP Heap Buffer Overflow (CVE-2023-4863) | Huntress
blogs_huntress·CVSS 8.8
CVE-2023-4863 [HIGH] Critical Vulnerability: WebP Heap Buffer Overflow (CVE-2023-4863) | Huntress
The Huntress team is currently investigating CVE-2023-4863, a heap buffer overflow in the WebP image encoding/decoding (codec) library (libwebp). Threat actors are exploiting this critical vulnerability in the wild, which affects anything using the libwebp library version prior to 1.3.2.
This is a rapidly evolving situation, and we will update this blog post with information we receive and confirm—but here’s everything we know so far:
## What’s Happening?
- WebP is a common image format that supports lossless and lossy compression for web-based images. It is similar to the JPG, PNG, and SVG formats and is natively supported by most common web browsers like Google Chrome, Safari, Firefox, and Edge.
- The attack is accomplished by presenting a crafted WebP lossless file to software using
2023-09-25
Published
Exploited in the wild