Ubuntu 23.04, 22.04 LTS: USN-6369-1 Moderate: libwebp Denial of Service

ubuntu

September 14, 2023

libwebp could be made to crash or run programs if it opened a specially crafted file.

Summary

libwebp could be made to crash or run programs if it opened a specially

crafted file.

Software Description:

- libwebp: Lossy compression of digital photographic images

Details:

It was discovered that libwebp incorrectly handled certain malformed

images. If a user or automated system were tricked into opening a

specially crafted image file, a remote attacker could use this issue to

cause libwebp to crash, resulting in a denial of service, or possibly

execute arbitrary code.

Topics Covered

security advisory denial of service software update ubuntu libwebp

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
   libwebp7                        1.2.4-0.1ubuntu0.23.04.2
   libwebpdemux2                   1.2.4-0.1ubuntu0.23.04.2
   libwebpmux3                     1.2.4-0.1ubuntu0.23.04.2

Ubuntu 22.04 LTS:
   libwebp7                        1.2.2-2ubuntu0.22.04.2
   libwebpdemux2                   1.2.2-2ubuntu0.22.04.2
   libwebpmux3                     1.2.2-2ubuntu0.22.04.2

Ubuntu 20.04 LTS:
   libwebp6                        0.6.1-2ubuntu0.20.04.3
   libwebpdemux2                   0.6.1-2ubuntu0.20.04.3
   libwebpmux3                     0.6.1-2ubuntu0.20.04.3

In general, a standard system update will make all the necessary changes.