by Kastro
Paper/Archive/CVE-2020-36329

CVE-2020-36329

redhat — A flaw was found in libwebp in versions before 1.0.1.

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 83.5.835 × 2016.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected

ProductAffectedFixed inSource
libwebplibwebp 1.0.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refbugzilla.redhat.com/show_bug.cgi?id=1956843reflists.debian.org/debian-lts-announce/2021/06/msg00005.htmlreflists.debian.org/debian-lts-announce/2021/06/msg00006.htmladvisorydebian.org/security/2021/dsa-4930refsupport.apple.com/kb/HT212601refseclists.org/fulldisclosure/2021/Jul/54refsecurity.netapp.com/advisory/ntap-20211112-0001