Heap-based buffer overflow in libwebp - CVE-2020-36328

Vulnerability identifier: #VU53843

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-36328

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in WebPDecodeRGBInto function in libwebp.  A remote attacker can create a specially crafted file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

libwebp
Amazon Linux AMI
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Enterprise Storage
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
CentOS
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
iPadOS
Apple iOS
Ubuntu
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Workstation Extension
libwebp (Debian package)
libwebp (Red Hat package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
SUSE Linux Enterprise Module for Packagehub Subpackages
libwebpmux1 (Ubuntu package)
libwebpdemux1 (Ubuntu package)
libwebp5 (Ubuntu package)
libwebpdecoder2-debuginfo
libwebp6-32bit-debuginfo
libwebp6-32bit
libwebpmux2-debuginfo
libwebpmux2
libwebpextras0-debuginfo
libwebpextras0
libwebpdemux2-debuginfo
libwebpdemux2
libwebpdecoder2
libwebp6
libwebp6-debuginfo
libwebp-devel
libwebp-debugsource
libwebpmux3 (Ubuntu package)
libwebp6 (Ubuntu package)
libwebpdemux2 (Ubuntu package)
libwebp
qt5-qtimageformats (Red Hat package)
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Cloud Pak for Security (CP4S)

Install updates from vendor's website.

libwebp - update to 1.0.1
libwebp (Debian package) - update to 0.6.1-2+deb10u1
libwebp (Red Hat package) - addressed in versions 0.3.0-10.el7_9, 1.0.0-3.el8_4, 1.0.0-4.el8_1, 1.0.0-4.el8_2
Migration Toolkit for Containers - update to 1.4.6
Cloud Pak for Security (CP4S) - update to 1.8.0.0
Red Hat OpenShift Container Platform - update to 4.6.38
iPadOS - addressed in versions 14.7 18G69, 14.7 18G70
Apple iOS - update to 14.7 18G69
libwebpmux1 (Ubuntu package) - update to 0.4.41ubuntu0.1~esm1
libwebpdemux1 (Ubuntu package) - update to 0.4.41ubuntu0.1~esm1
libwebp5 (Ubuntu package) - update to 0.4.41ubuntu0.1~esm1
libwebpdecoder2-debuginfo - update to 0.5.0-3.5.1
libwebp6-32bit-debuginfo - update to 0.5.0-3.5.1
libwebp6-32bit - update to 0.5.0-3.5.1
libwebpmux2-debuginfo - update to 0.5.0-3.5.1
libwebpmux2 - update to 0.5.0-3.5.1
libwebpextras0-debuginfo - update to 0.5.0-3.5.1
libwebpextras0 - update to 0.5.0-3.5.1
libwebpdemux2-debuginfo - update to 0.5.0-3.5.1
libwebpdemux2 - update to 0.5.0-3.5.1
libwebpdecoder2 - update to 0.5.0-3.5.1
libwebp6 - update to 0.5.0-3.5.1
libwebp6-debuginfo - update to 0.5.0-3.5.1
libwebp-devel - update to 0.5.0-3.5.1
libwebp-debugsource - update to 0.5.0-3.5.1
libwebpmux3 (Ubuntu package) - addressed in versions 0.6.1-2ubuntu0.18.04.1, 0.6.1-2ubuntu0.20.04.1, 0.6.1-2ubuntu0.20.10.1, 0.6.1-2ubuntu0.21.04.1
libwebp6 (Ubuntu package) - addressed in versions 0.6.1-2ubuntu0.18.04.1, 0.6.1-2ubuntu0.20.04.1, 0.6.1-2ubuntu0.20.10.1, 0.6.1-2ubuntu0.21.04.1
libwebpdemux2 (Ubuntu package) - addressed in versions 0.6.1-2ubuntu0.18.04.1, 0.6.1-2ubuntu0.20.04.1, 0.6.1-2ubuntu0.20.10.1, 0.6.1-2ubuntu0.21.04.1
libwebp - addressed in versions 1.0.0-3, 1.0.0-4
libwebp-devel - addressed in versions 1.0.0-3, 1.0.0-4
qt5-qtimageformats (Red Hat package) - update to 5.9.7-2.el7_9

• https://bugzilla.redhat.com/show_bug.cgi?id=1956829
• https://lists.debian.org/debian-lts-announce/2021/06/msg00005.html
• https://lists.debian.org/debian-lts-announce/2021/06/msg00006.html

• Multiple vulnerabilities in libwebp
• Red Hat Enterprise Linux 7 update for libwebp
• Red Hat Enterprise Linux 8 update for libwebp
• Red Hat Enterprise Linux 8.2 update for libwebp
• Red Hat Enterprise Linux 8.1 update for libwebp
• Red Hat Enterprise Linux 7 update for qt5-qtimageformats
• Debian update for libwebp
• CentOS 7 update for qt5-qtimageformats
• Multiple vulnerabilities in OpenShift Container Platform 4.6
• Multiple vulnerabilities in Apple iOS and iPadOS
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers
• Amazon Linux AMI update for libwebp
• SUSE update for libwebp
• Ubuntu update for libwebp
• Ubuntu update for libwebp
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Anolis OS update for libwebp (Anolis OS 8.2)
• Anolis OS update for libwebp (Anolis OS 8.4)