by Kastro
Paper/Archive/CVE-2020-36328

CVE-2020-36328

redhat — A flaw was found in libwebp in versions before 1.0.1.

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 85.7.857 × 2017.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected

ProductAffectedFixed inSource
libwebplibwebp 1.0.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refbugzilla.redhat.com/show_bug.cgi?id=1956829reflists.debian.org/debian-lts-announce/2021/06/msg00005.htmlreflists.debian.org/debian-lts-announce/2021/06/msg00006.htmladvisorydebian.org/security/2021/dsa-4930refsupport.apple.com/kb/HT212601refseclists.org/fulldisclosure/2021/Jul/54refsecurity.netapp.com/advisory/ntap-20211112-0001