Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 22 Sep 2023 12:54:11 +0200
From: Solar Designer <>
Cc: Vincent Rabaud <>
Subject: Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec

On Fri, Sep 22, 2023 at 07:28:17AM +0200, Hanno B??ck wrote:
> On Thu, 21 Sep 2023 22:52:50 +0200 Solar Designer <> wrote:
> > However, another maybe-important one also made it into 1.3.2:
> > 
> > commit 95ea5226c870449522240ccff26f0b006037c520
> > Author: Vincent Rabaud <>
> > Date:   Mon Sep 11 16:06:08 2023 +0200
> > 
> >     Fix invalid incremental decoding check.
> It does not look to me that this fix is in 1.3.2:
> I've seen this commit as well and have been wondering for a few days if
> we'll hear about abother libwebp issue soon.

Oh, you're correct - this commit is _not_ in 1.3.2.

I was looking at the main branch and wrongly assumed that all I see in
there before:

commit ca332209cb5567c9b249c86788cb2dbf8847e760 (tag: v1.3.2, origin/1.3.2)

is in 1.3.2.  However, that commit tagged 1.3.2 got into main as part of
a merge commit, by which point main already had other commits including
95ea5226c870449522240ccff26f0b006037c520 that were not in 1.3.2 branch/tag.

So there may be 1 to 3 commits fixing more security issues after 1.3.2.

Thank you for correcting me!


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.