webmproject / libwebp CVEs

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML pa…

There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. Th…

A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threat from this vulnerability is to the ser…

A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability is to data confidenti…

A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confi…

A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early. The highest threat from this vulnerability is to data conf…

A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest t…

A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes().

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24().

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16().

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16().

In libwebp 0.5.1, there is a double free bug in libwebpmux.

Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.