Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Ubuntu 14.04/16.04 ESM: 4971-2 Moderate: libwebp Remote Code Execution

ubuntu
Calendar Grey June 10, 2021
Dist Ubuntu Esm H88
Security notice for Ubuntu concerning vulnerabilities in libwebp impacting various releases. Upgrade is necessary to reduce potential risks.
libwebp could be made to crash or run programs as your login if it opened a specially crafted file.

Summary

libwebp could be made to crash or run programs as your login if it

opened a specially crafted file.

Software Description:

- libwebp: Lossy compression of digital photographic images.

Details:

USN-4971-1 fixed several vulnerabilities in libwebp. This update provides

the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that libwebp incorrectly handled certain malformed

images. If a user or automated system were tricked into opening a specially

crafted image file, a remote attacker could use this issue to cause libwebp

to crash, resulting in a denial of service, or possibly execute arbitrary

code.

Topics%20covered

Topics Covered

security advisory moderate denial of service remote code execution libwebp

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 ESM:
  libwebp5                        0.4.4-1ubuntu0.1~esm1
  libwebpdemux1                   0.4.4-1ubuntu0.1~esm1
  libwebpmux1                     0.4.4-1ubuntu0.1~esm1

Ubuntu 14.04 ESM:
  libwebp5                        0.4.0-4ubuntu0.1~esm1
  libwebpdemux1                   0.4.0-4ubuntu0.1~esm1
  libwebpmux1                     0.4.0-4ubuntu0.1~esm1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4971-2

https://ubuntu.com/security/notices/USN-4971-1

CVE-2018-25009, CVE-2018-25010, CVE-2018-25011, CVE-2018-25012,

CVE-2018-25013, CVE-2018-25014, CVE-2020-36328, CVE-2020-36329,

CVE-2020-36330, CVE-2020-36331

June 10, 2021

Topics%20covered

Topics Covered

security advisory moderate denial of service remote code execution libwebp

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here