Date: Tue, 26 Sep 2023 11:43:45 +0200 From: Salvatore Bonaccorso <carnil@...ian.org> To: oss-security@...ts.openwall.com Subject: Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec Hi, On Thu, Sep 21, 2023 at 10:52:50PM +0200, Solar Designer wrote: > Hi, > > Ideally this should have been brought in here ~10 days ago, but I guess > better late than never, and I'd like to encourage others to be bringing > relevant stuff to the list. > > On September 11, Google announced an update to Chrome: > > https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html > > fixing this issue: > > > Critical CVE-2023-4863: Heap buffer overflow in WebP. Reported by Apple > > Security Engineering and Architecture (SEAR) and The Citizen Lab at The > > University of Toronto's Munk School on 2023-09-06 > > > > We would also like to thank all security researchers that worked with us > > during the development cycle to prevent security bugs from ever reaching > > the stable channel. > > > > Google is aware that an exploit for CVE-2023-4863 exists in the wild. > > With the bug being in a library used by many projects, this made people > wonder why a CVE was assigned to Chrome rather than to libwebp: > > https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/ Maybe related to this question in todays CVEs updates there appeared https://www.cve.org/CVERecord?id=CVE-2023-5129 vs. https://www.cve.org/CVERecord?id=CVE-2023-4863 FWIW, I contacted the assigning CNAs so this can be clarified (e.g. if one of those needs to be rejected). Regards, Salvatore
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.