Linux · Security advisory · November 9, 2021
RLSA-2021:4231: libwebp security update
RLSA-2021:4231, released November 9, 2021, fixes 8 CVEs in libwebp (version 0:1.0.0-5.el8). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
8
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0230
83rd percentile
Priority of the 8 CVEs
Patch now 0
Urgent 0
High 8
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| libwebp | rocky 8 | 0:1.0.0-5.el8 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2020-36331 | libwebp: The libwebp packages provide a library and tools for the WebP graphics format | 9.8 | 0.0230 | None reported | |
| High | CVE-2018-25010 | libwebp: The libwebp packages provide a library and tools for the WebP graphics format | 9.8 | 0.0224 | None reported | |
| High | CVE-2018-25014 | libwebp6: A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol(). | 9.8 | 0.0223 | None reported | |
| High | CVE-2020-36330 | libwebp: The libwebp packages provide a library and tools for the WebP graphics format | 9.8 | 0.0223 | None reported | |
| High | CVE-2018-25009 | libwebp: The libwebp packages provide a library and tools for the WebP graphics format | 9.8 | 0.0210 | None reported | |
| High | CVE-2018-25012 | libwebp: The libwebp packages provide a library and tools for the WebP graphics format | 9.8 | 0.0205 | None reported | |
| High | CVE-2018-25013 | webp: A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes(). | 9.8 | 0.0205 | None reported | |
| High | CVE-2020-36332 | libsharpyuv0: A flaw was found in libwebp in versions before 1.0.1 | 9.8 | 0.0197 | None reported |
Showing 1 to 8 of 8
1