CVE-2020-36331 A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability is to data confidentiality and to the serv...
CriticalCVSS 9.1
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability is to data confidentiality and to the service availability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libwebp(Debian:12) | < 0.6.1-2.1 | 0.6.1-2.1 |
| debian/libwebp(Debian:13) | < 0.6.1-2.1 | 0.6.1-2.1 |
| debian/libwebp(Debian:14) | < 0.6.1-2.1 | 0.6.1-2.1 |
| webmproject libwebp | < 1.0.1 | 1.0.1 |
| redhat enterprise linux | = 8.0 | No fix listed |
| netapp ontap select deploy administration utility | All versions | No fix listed |
| debian linux | = 9.0 | No fix listed |
| debian linux | = 10.0 | No fix listed |
| apple iPadOS | < 14.7 | 14.7 |
| apple iphone os | < 14.7 | 14.7 |
References
- Debian Security Tracker CVE-2020-36331 vendor-advisory
- 20210723 APPLE-SA-2021-07-21-1 iOS 14.7 and iPadOS 14.7 mailing-list third-party-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- [debian-lts-announce] 20210605 [SECURITY] [DLA 2672-1] libwebp security update mailing-list third-party-advisory
- [debian-lts-announce] 20210606 [SECURITY] [DLA 2677-1] libwebp security update mailing-list third-party-advisory
- security.netapp.com third-party-advisory
- support.apple.com third-party-advisory
- DSA-4930 mailing-list third-party-advisory vendor-advisory