Search for packages
Package details: pkg:conan/libwebp@0.4.2
purl pkg:conan/libwebp@0.4.2
Tags Ghost
Next non-vulnerable version 1.3.2
Latest non-vulnerable version 1.3.2
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-2svv-d2xq-aaan
Aliases:
CVE-2023-1999
There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. 
1.3.1
Affected by 1 other vulnerability.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2024-09-17T22:47:58.753755+00:00 GitLab Importer Affected by VCID-2svv-d2xq-aaan https://gitlab.com/gitlab-org/advisories-community/-/blob/main/conan/libwebp/CVE-2023-1999.yml 34.0.1
2024-01-03T18:09:03.315944+00:00 GitLab Importer Affected by VCID-2svv-d2xq-aaan https://gitlab.com/gitlab-org/advisories-community/-/blob/main/conan/libwebp/CVE-2023-1999.yml 34.0.0rc1