CVE Vulnerabilities

CVE-2023-1999

Double Free

Published: Jun 20, 2023 | Modified: Sep 17, 2023
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
7.5 IMPORTANT
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM

There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. 

Weakness

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

Affected Software

Name Vendor Start Version End Version
Libwebp Webmproject 0.4.2 (including) 1.3.1 (excluding)
Red Hat Enterprise Linux 7 RedHat firefox-0:102.10.0-1.el7_9 *
Red Hat Enterprise Linux 7 RedHat thunderbird-0:102.10.0-2.el7_9 *
Red Hat Enterprise Linux 7 RedHat libwebp-0:0.3.0-11.el7 *
Red Hat Enterprise Linux 8 RedHat firefox-0:102.10.0-1.el8_7 *
Red Hat Enterprise Linux 8 RedHat thunderbird-0:102.10.0-2.el8_7 *
Red Hat Enterprise Linux 8 RedHat libwebp-0:1.0.0-8.el8_7 *
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions RedHat firefox-0:102.10.0-1.el8_1 *
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions RedHat thunderbird-0:102.10.0-2.el8_1 *
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions RedHat libwebp-0:1.0.0-5.2.el8_1 *
Red Hat Enterprise Linux 8.2 Advanced Update Support RedHat firefox-0:102.10.0-1.el8_2 *
Red Hat Enterprise Linux 8.2 Advanced Update Support RedHat thunderbird-0:102.10.0-2.el8_2 *
Red Hat Enterprise Linux 8.2 Advanced Update Support RedHat libwebp-0:1.0.0-7.el8_2 *
Red Hat Enterprise Linux 8.2 Telecommunications Update Service RedHat firefox-0:102.10.0-1.el8_2 *
Red Hat Enterprise Linux 8.2 Telecommunications Update Service RedHat thunderbird-0:102.10.0-2.el8_2 *
Red Hat Enterprise Linux 8.2 Telecommunications Update Service RedHat libwebp-0:1.0.0-7.el8_2 *
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions RedHat firefox-0:102.10.0-1.el8_2 *
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions RedHat thunderbird-0:102.10.0-2.el8_2 *
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions RedHat libwebp-0:1.0.0-7.el8_2 *
Red Hat Enterprise Linux 8.4 Extended Update Support RedHat firefox-0:102.10.0-1.el8_4 *
Red Hat Enterprise Linux 8.4 Extended Update Support RedHat thunderbird-0:102.10.0-2.el8_4 *
Red Hat Enterprise Linux 8.4 Extended Update Support RedHat libwebp-0:1.0.0-7.el8_4 *
Red Hat Enterprise Linux 8.6 Extended Update Support RedHat firefox-0:102.10.0-1.el8_6 *
Red Hat Enterprise Linux 8.6 Extended Update Support RedHat thunderbird-0:102.10.0-2.el8_6 *
Red Hat Enterprise Linux 8.6 Extended Update Support RedHat libwebp-0:1.0.0-7.el8_6 *
Red Hat Enterprise Linux 9 RedHat firefox-0:102.10.0-1.el9_1 *
Red Hat Enterprise Linux 9 RedHat thunderbird-0:102.10.0-2.el9_1 *
Red Hat Enterprise Linux 9 RedHat libwebp-0:1.2.0-6.el9_1 *
Red Hat Enterprise Linux 9.0 Extended Update Support RedHat firefox-0:102.10.0-1.el9_0 *
Red Hat Enterprise Linux 9.0 Extended Update Support RedHat thunderbird-0:102.10.0-2.el9_0 *
Red Hat Enterprise Linux 9.0 Extended Update Support RedHat libwebp-0:1.2.0-5.el9_0 *
Firefox Ubuntu trusty *
Firefox Ubuntu upstream *
Firefox Ubuntu xenial *
Libwebp Ubuntu bionic *
Libwebp Ubuntu devel *
Libwebp Ubuntu esm-infra/bionic *
Libwebp Ubuntu esm-infra/xenial *
Libwebp Ubuntu focal *
Libwebp Ubuntu jammy *
Libwebp Ubuntu kinetic *
Libwebp Ubuntu lunar *
Libwebp Ubuntu mantic *
Libwebp Ubuntu noble *
Libwebp Ubuntu trusty *
Libwebp Ubuntu xenial *
Mozjs38 Ubuntu bionic *
Mozjs52 Ubuntu bionic *
Mozjs78 Ubuntu kinetic *
Mozjs78 Ubuntu lunar *
Thunderbird Ubuntu bionic *
Thunderbird Ubuntu devel *
Thunderbird Ubuntu focal *
Thunderbird Ubuntu jammy *
Thunderbird Ubuntu kinetic *
Thunderbird Ubuntu lunar *
Thunderbird Ubuntu mantic *
Thunderbird Ubuntu noble *
Thunderbird Ubuntu trusty *
Thunderbird Ubuntu xenial *

Potential Mitigations

References