Headline
Red Hat Security Advisory 2023-2072-01
Red Hat Security Advisory 2023-2072-01 - The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format. Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently. Issues addressed include a double free vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: libwebp security update
Advisory ID: RHSA-2023:2072-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:2072
Issue date: 2023-05-02
CVE Names: CVE-2023-1999
=====================================================================
- Summary:
An update for libwebp is now available for Red Hat Enterprise Linux 8.2
Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications
Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP
Solutions.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux AppStream AUS (v. 8.2) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux AppStream E4S (v. 8.2) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux AppStream TUS (v. 8.2) - aarch64, ppc64le, s390x, x86_64
- Description:
The libwebp packages provide a library and tools for the WebP graphics
format. WebP is an image format with a lossy compression of digital
photographic images. WebP consists of a codec based on the VP8 format, and
a container based on the Resource Interchange File Format (RIFF).
Webmasters, web developers and browser developers can use WebP to compress,
archive, and distribute digital images more efficiently.
Security Fix(es):
- Mozilla: libwebp: Double-free in libwebp (CVE-2023-1999)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2186102 - CVE-2023-1999 Mozilla: libwebp: Double-free in libwebp
- Package List:
Red Hat Enterprise Linux AppStream AUS (v. 8.2):
Source:
libwebp-1.0.0-7.el8_2.src.rpm
aarch64:
libwebp-1.0.0-7.el8_2.aarch64.rpm
libwebp-debuginfo-1.0.0-7.el8_2.aarch64.rpm
libwebp-debugsource-1.0.0-7.el8_2.aarch64.rpm
libwebp-devel-1.0.0-7.el8_2.aarch64.rpm
libwebp-java-debuginfo-1.0.0-7.el8_2.aarch64.rpm
libwebp-tools-debuginfo-1.0.0-7.el8_2.aarch64.rpm
ppc64le:
libwebp-1.0.0-7.el8_2.ppc64le.rpm
libwebp-debuginfo-1.0.0-7.el8_2.ppc64le.rpm
libwebp-debugsource-1.0.0-7.el8_2.ppc64le.rpm
libwebp-devel-1.0.0-7.el8_2.ppc64le.rpm
libwebp-java-debuginfo-1.0.0-7.el8_2.ppc64le.rpm
libwebp-tools-debuginfo-1.0.0-7.el8_2.ppc64le.rpm
s390x:
libwebp-1.0.0-7.el8_2.s390x.rpm
libwebp-debuginfo-1.0.0-7.el8_2.s390x.rpm
libwebp-debugsource-1.0.0-7.el8_2.s390x.rpm
libwebp-devel-1.0.0-7.el8_2.s390x.rpm
libwebp-java-debuginfo-1.0.0-7.el8_2.s390x.rpm
libwebp-tools-debuginfo-1.0.0-7.el8_2.s390x.rpm
x86_64:
libwebp-1.0.0-7.el8_2.i686.rpm
libwebp-1.0.0-7.el8_2.x86_64.rpm
libwebp-debuginfo-1.0.0-7.el8_2.i686.rpm
libwebp-debuginfo-1.0.0-7.el8_2.x86_64.rpm
libwebp-debugsource-1.0.0-7.el8_2.i686.rpm
libwebp-debugsource-1.0.0-7.el8_2.x86_64.rpm
libwebp-devel-1.0.0-7.el8_2.i686.rpm
libwebp-devel-1.0.0-7.el8_2.x86_64.rpm
libwebp-java-debuginfo-1.0.0-7.el8_2.i686.rpm
libwebp-java-debuginfo-1.0.0-7.el8_2.x86_64.rpm
libwebp-tools-debuginfo-1.0.0-7.el8_2.i686.rpm
libwebp-tools-debuginfo-1.0.0-7.el8_2.x86_64.rpm
Red Hat Enterprise Linux AppStream E4S (v. 8.2):
Source:
libwebp-1.0.0-7.el8_2.src.rpm
aarch64:
libwebp-1.0.0-7.el8_2.aarch64.rpm
libwebp-debuginfo-1.0.0-7.el8_2.aarch64.rpm
libwebp-debugsource-1.0.0-7.el8_2.aarch64.rpm
libwebp-devel-1.0.0-7.el8_2.aarch64.rpm
libwebp-java-debuginfo-1.0.0-7.el8_2.aarch64.rpm
libwebp-tools-debuginfo-1.0.0-7.el8_2.aarch64.rpm
ppc64le:
libwebp-1.0.0-7.el8_2.ppc64le.rpm
libwebp-debuginfo-1.0.0-7.el8_2.ppc64le.rpm
libwebp-debugsource-1.0.0-7.el8_2.ppc64le.rpm
libwebp-devel-1.0.0-7.el8_2.ppc64le.rpm
libwebp-java-debuginfo-1.0.0-7.el8_2.ppc64le.rpm
libwebp-tools-debuginfo-1.0.0-7.el8_2.ppc64le.rpm
s390x:
libwebp-1.0.0-7.el8_2.s390x.rpm
libwebp-debuginfo-1.0.0-7.el8_2.s390x.rpm
libwebp-debugsource-1.0.0-7.el8_2.s390x.rpm
libwebp-devel-1.0.0-7.el8_2.s390x.rpm
libwebp-java-debuginfo-1.0.0-7.el8_2.s390x.rpm
libwebp-tools-debuginfo-1.0.0-7.el8_2.s390x.rpm
x86_64:
libwebp-1.0.0-7.el8_2.i686.rpm
libwebp-1.0.0-7.el8_2.x86_64.rpm
libwebp-debuginfo-1.0.0-7.el8_2.i686.rpm
libwebp-debuginfo-1.0.0-7.el8_2.x86_64.rpm
libwebp-debugsource-1.0.0-7.el8_2.i686.rpm
libwebp-debugsource-1.0.0-7.el8_2.x86_64.rpm
libwebp-devel-1.0.0-7.el8_2.i686.rpm
libwebp-devel-1.0.0-7.el8_2.x86_64.rpm
libwebp-java-debuginfo-1.0.0-7.el8_2.i686.rpm
libwebp-java-debuginfo-1.0.0-7.el8_2.x86_64.rpm
libwebp-tools-debuginfo-1.0.0-7.el8_2.i686.rpm
libwebp-tools-debuginfo-1.0.0-7.el8_2.x86_64.rpm
Red Hat Enterprise Linux AppStream TUS (v. 8.2):
Source:
libwebp-1.0.0-7.el8_2.src.rpm
aarch64:
libwebp-1.0.0-7.el8_2.aarch64.rpm
libwebp-debuginfo-1.0.0-7.el8_2.aarch64.rpm
libwebp-debugsource-1.0.0-7.el8_2.aarch64.rpm
libwebp-devel-1.0.0-7.el8_2.aarch64.rpm
libwebp-java-debuginfo-1.0.0-7.el8_2.aarch64.rpm
libwebp-tools-debuginfo-1.0.0-7.el8_2.aarch64.rpm
ppc64le:
libwebp-1.0.0-7.el8_2.ppc64le.rpm
libwebp-debuginfo-1.0.0-7.el8_2.ppc64le.rpm
libwebp-debugsource-1.0.0-7.el8_2.ppc64le.rpm
libwebp-devel-1.0.0-7.el8_2.ppc64le.rpm
libwebp-java-debuginfo-1.0.0-7.el8_2.ppc64le.rpm
libwebp-tools-debuginfo-1.0.0-7.el8_2.ppc64le.rpm
s390x:
libwebp-1.0.0-7.el8_2.s390x.rpm
libwebp-debuginfo-1.0.0-7.el8_2.s390x.rpm
libwebp-debugsource-1.0.0-7.el8_2.s390x.rpm
libwebp-devel-1.0.0-7.el8_2.s390x.rpm
libwebp-java-debuginfo-1.0.0-7.el8_2.s390x.rpm
libwebp-tools-debuginfo-1.0.0-7.el8_2.s390x.rpm
x86_64:
libwebp-1.0.0-7.el8_2.i686.rpm
libwebp-1.0.0-7.el8_2.x86_64.rpm
libwebp-debuginfo-1.0.0-7.el8_2.i686.rpm
libwebp-debuginfo-1.0.0-7.el8_2.x86_64.rpm
libwebp-debugsource-1.0.0-7.el8_2.i686.rpm
libwebp-debugsource-1.0.0-7.el8_2.x86_64.rpm
libwebp-devel-1.0.0-7.el8_2.i686.rpm
libwebp-devel-1.0.0-7.el8_2.x86_64.rpm
libwebp-java-debuginfo-1.0.0-7.el8_2.i686.rpm
libwebp-java-debuginfo-1.0.0-7.el8_2.x86_64.rpm
libwebp-tools-debuginfo-1.0.0-7.el8_2.i686.rpm
libwebp-tools-debuginfo-1.0.0-7.el8_2.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2023-1999
https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBZFD5wdzjgjWX9erEAQjJKQ/9HbwIor17yqVQrdioZABmhdqhaD8+mnpT
MsFHxNToMGliyo+2IBS9OfofWJtpLHC2SG3+fXTywmkW2rUx12t6CWWxiag1RXoB
VRyQsGH7igzPQzNZ3kE5WDm7+/hehNGEfaxJ8VzS5ngD535I/r+PS9Mn1hM1k0Is
JFWqeZxhN8NhgypU8tQsZAUWrtFrEtdXbVUWunMxAMWHzpAznTj7DzKxodtrdJEN
rkxILB6sGc7oC8kG8WO6bZjMb+gO4gREsl67UXf/3LuchVCLDNlmo4nmaiMgu3gb
UJgLKq7ztWrFM/wcBIJLceD+4rJkAciyOImzy7GIoor0XzV2KjQ3t56qF57FoleH
vhzMrE9DPFWoMI70aim7ZGQ5wUI2Q+x363+eYsHErwfTEeuKEKgdVPOJMmmzMkEN
J70hK9cFA/36U/PPdenSZKF6prHYuwXYg7/aP0ELRsaGw3Mw9vbdrkYSlNKbBEdk
kUgKkzjFGIg+lZST77ZGw5v8VuZJ3jTd1TkgYE2+fa0G+G/ZjKnm2sHSpkMmQ4Ss
molPH/tGMSAd2hqESL9MWDswjszRxo2NO9ajH6bpNyTGeTVHs07KoMufyICpRXlb
buylJlgHYgeTUcMM35nzF2PNQNt1jaZjvTBi/qCzkRCGew0Hx3I90zYolhlkTopU
GLiJuwwnVq0=
=o7JU
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
An issue exists in SoftIron HyperCloud where compute nodes may come online immediately without following the correct initialization process. In this instance, workloads may be scheduled on these nodes and deploy to a failed or erroneous state, which impacts the availability of these workloads that may be deployed during this time window. This issue impacts HyperCloud versions from 2.0.0 to before 2.0.3.
Red Hat Security Advisory 2023-3624-01 - The Migration Toolkit for Containers enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Issues addressed include a denial of service vulnerability.
Red Hat Security Advisory 2023-3356-01 - Red Hat Advanced Cluster Management for Kubernetes 2.5.9 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs.
Gentoo Linux Security Advisory 202305-35 - Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. Versions greater than or equal to 102.10.0:esr are affected.
Debian Linux Security Advisory 5408-1 - Irvan Kurniawan discovered a double free in the libwebp image compression library which may result in denial of service.
Red Hat Security Advisory 2023-2110-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.12.16. Issues addressed include a bypass vulnerability.
Red Hat Security Advisory 2023-2076-01 - The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format. Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently. Issues addressed include a double free vulnerability.
Red Hat Security Advisory 2023-2077-01 - The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format. Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently. Issues addressed include a double free vulnerability.
Red Hat Security Advisory 2023-2073-01 - The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format. Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently. Issues addressed include a double free vulnerability.
Red Hat Security Advisory 2023-2078-01 - The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format. Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently. Issues addressed include a double free vulnerability.
Red Hat Security Advisory 2023-2075-01 - The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format. Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently. Issues addressed include a double free vulnerability.
An update for libwebp is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-1999: The Mozilla Foundation Security Advisory describes this flaw as: A double-free in libwebp could have led to memory corruption and a potentially exploitable crash.
An update for libwebp is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-1999: The Mozilla Foundation Security Advisory describes this flaw as: A double-free in libwebp could have led to memory corruption and a potentially exploitable crash.
An update for libwebp is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-1999: The Mozilla Foundation Security Advisory describes this flaw as: A double-free in libwebp could have led to memory corruption and a potentially exploitable crash.
An update for libwebp is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-1999: The Mozilla Foundation Security Advisory describes this flaw as: A double-free in libwebp could have led to memory corruption and a potentially exploitable crash.
An update for libwebp is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-1999: The Mozilla Foundation Security Advisory describes this flaw as: A double-free in libwebp could have led to memory corruption and a potentially exploitable crash.
An update for libwebp is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-1999: The Mozilla Foundation Security Advisory describes this flaw as: A double-free in libwebp could have led to memory corruption and a potentially exploitable crash.
An update for libwebp is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-1999: The Mozilla Foundation Security Advisory describes this flaw as: A double-free in libwebp could have led to memory corruption and a potentially exploitable crash.
An update for libwebp is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-1999: The Mozilla Foundation Security Advisory describes this flaw as: A double-free in libwebp could have led to memory corruption and a potentially exploitable crash.
Firefox gets a needed tune-up, SolarWinds squashes two high-severity bugs, Oracle patches 433 vulnerabilities, and more updates you should make now.