Ubuntu 23.04 USN-6078-1 Important: libwebp Denial of Service Vulnerability

ubuntu

May 16, 2023

libwebp could be made to crash or run programs as your login if it opened a specially crafted file.

Summary

libwebp could be made to crash or run programs as your login if it opened a

specially crafted file.

Software Description:

- libwebp: Lossy compression of digital photographic images

Details:

Irvan Kurniawan discovered that libwebp incorrectly handled certain memory

operations. If a user or automated system were tricked into opening a

specially crafted image file, a remote attacker could use this issue to

cause libwebp to crash, resulting in a denial of service, or possibly

execute arbitrary code.

Topics Covered

security advisory denial of service critical issue code execution ubuntu library libwebp

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
   libwebp7                        1.2.4-0.1ubuntu0.23.04.1
   libwebpdemux2                   1.2.4-0.1ubuntu0.23.04.1
   libwebpmux3                     1.2.4-0.1ubuntu0.23.04.1

Ubuntu 22.10:
   libwebp7                        1.2.2-2ubuntu0.22.10.1
   libwebpdemux2                   1.2.2-2ubuntu0.22.10.1
   libwebpmux3                     1.2.2-2ubuntu0.22.10.1

Ubuntu 22.04 LTS:
   libwebp7                        1.2.2-2ubuntu0.22.04.1
   libwebpdemux2                   1.2.2-2ubuntu0.22.04.1
   libwebpmux3                     1.2.2-2ubuntu0.22.04.1

Ubuntu 20.04 LTS:
   libwebp6                        0.6.1-2ubuntu0.20.04.2
   libwebpdemux2                   0.6.1-2ubuntu0.20.04.2
   libwebpmux3                     0.6.1-2ubuntu0.20.04.2

Ubuntu 18.04 LTS:
   libwebp6                        0.6.1-2ubuntu0.18.04.2
   libwebpdemux2                   0.6.1-2ubuntu0.18.04.2
   libwebpmux3                     0.6.1-2ubuntu0.18.04.2

In general, a standard system update will make all the necessary changes.