CVE-2020-36328

moderate-risk
Published 2021-05-21

A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Do I need to act?

-
0.53% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (8)

Libwebp

Affected Vendors

Debian Redhat Apple Netapp Webmproject

References (14)

Mailing List http://seclists.org/fulldisclosure/2021/Jul/54
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1956829
Mailing List https://lists.debian.org/debian-lts-announce/2021/06/msg00005.html
Mailing List https://lists.debian.org/debian-lts-announce/2021/06/msg00006.html
Third Party Advisory https://security.netapp.com/advisory/ntap-20211112-0001/
Third Party Advisory https://support.apple.com/kb/HT212601
Third Party Advisory https://www.debian.org/security/2021/dsa-4930
Mailing List http://seclists.org/fulldisclosure/2021/Jul/54
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1956829
Mailing List https://lists.debian.org/debian-lts-announce/2021/06/msg00005.html
Mailing List https://lists.debian.org/debian-lts-announce/2021/06/msg00006.html
Third Party Advisory https://security.netapp.com/advisory/ntap-20211112-0001/
Third Party Advisory https://support.apple.com/kb/HT212601
Third Party Advisory https://www.debian.org/security/2021/dsa-4930
48
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 2/34 · Minimal
Exposure 14/34 · Moderate