CVE-2023-5129
high
CVSS v3
—
CVSS v2
—
VIR risk
8.0
Description
libwebp: OOB write in BuildHuffmanTable
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2023:5214
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2023-5129.html
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2023:5201
Vendor advisory: redhat — https://access.redhat.com/errata/RHSA-2023:5224
Vendor advisory: redhat — https://access.redhat.com/errata/RHSA-2023:5214
Vendor advisory: redhat — https://access.redhat.com/errata/RHSA-2023:5200
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rhel | 9 | fixed | |
| rocky | 8 | fixed | |
| sles | affected | | |
| rocky | 9 | fixed | |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| crates.io | libwebp-sys | | |
| crates.io | libwebp-sys2 | | |
| crates.io | libwebp-sys2 | <0.1.8 | 0.1.8 |
| crates.io | libwebp-sys | <0.9.3 | 0.9.3 |
| npm | electron | >=22.0.0,<22.3.24 | 22.3.24 |
| npm | electron | >=24.0.0,<24.8.3 | 24.8.3 |
| npm | electron | >=25.0.0,<25.8.1 | 25.8.1 |
| npm | electron | >=26.0.0,<26.2.1 | 26.2.1 |
| npm | electron | >=27.0.0-beta.1,<27.0.0-beta.2 | 27.0.0-beta.2 |
| NuGet | SkiaSharp | >=2.0.0,<2.88.6 | 2.88.6 |
| Go | github.com/chai2010/webp | >=1.1.2,<1.4.0 | 1.4.0 |
| PyPI | pillow | <10.0.1 | 10.0.1 |
| crates.io | webp | <0.2.6 | 0.2.6 |
| NuGet | magick.net-q16-anycpu | <13.3.0 | 13.3.0 |
| NuGet | magick.net-q16-hdri-anycpu | <13.3.0 | 13.3.0 |
| NuGet | magick.net-q16-x64 | <13.3.0 | 13.3.0 |
| NuGet | magick.net-q8-anycpu | <13.3.0 | 13.3.0 |
| NuGet | magick.net-q8-openmp-x64 | <13.3.0 | 13.3.0 |
| NuGet | magick.net-q8-x64 | <13.3.0 | 13.3.0 |
| Go | github.com/chai2010/webp | <0.0.0-20250406010349-76805d5a8860 | 0.0.0-20250406010349-76805d5a8860 |
| Go | github.com/chai2010/webp | >=0.0.0,<1.1.2-0.20250406010349-76805d5a8860 | 1.1.2-0.20250406010349-76805d5a8860 |
| crates.io | libwebp-sys | >=0.0.0-0,<0.9.3 | 0.9.3 |
| crates.io | libwebp-sys2 | >=0.0.0-0,<0.1.8 | 0.1.8 |
References
- https://access.redhat.com/errata/RHSA-2023:5200
- https://access.redhat.com/errata/RHSA-2023:5214
- https://access.redhat.com/errata/RHSA-2023:5224
- https://nvd.nist.gov/vuln/detail/CVE-2023-4863
- https://github.com/qnighy/libwebp-sys2-rs/pull/21
- https://github.com/python-pillow/Pillow/pull/7395
- https://github.com/jaredforth/webp/pull/30
- https://github.com/electron/electron/pull/39823
- https://github.com/electron/electron/pull/39825
- https://github.com/electron/electron/pull/39826
- https://github.com/electron/electron/pull/39827
- https://github.com/electron/electron/pull/39828
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
- https://github.com/qnighy/libwebp-sys2-rs/commit/4560c473a76ec8bd8c650f19ddf9d7a44f719f8b
- https://github.com/jaredforth/webp/commit/9d4c56e63abecc777df71c702503c3eaabd7dcbc
- https://security.gentoo.org/glsa/202401-10
- https://security.gentoo.org/glsa/202309-05
- https://security-tracker.debian.org/tracker/CVE-2023-4863
- https://rustsec.org/advisories/RUSTSEC-2023-0061.html
- https://rustsec.org/advisories/RUSTSEC-2023-0060.html
- https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html#security
- https://news.ycombinator.com/item?id=37478403
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
- https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway
- https://security.netapp.com/advisory/ntap-20230929-0011
Verify integrity in audit chain (admin only). AS-IS.