by Kastro
Paper/Archive/CVE-2020-36330

CVE-2020-36330

redhat — A flaw was found in libwebp in versions before 1.0.1.

EPSS 2%CVSS 9.1
critical.is priorityof 100
44
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 82.8.828 × 2016.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the service availability.

Affected

ProductAffectedFixed inSource
libwebplibwebp 1.0.1–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

refbugzilla.redhat.com/show_bug.cgi?id=1956853reflists.debian.org/debian-lts-announce/2021/06/msg00005.htmlreflists.debian.org/debian-lts-announce/2021/06/msg00006.htmladvisorydebian.org/security/2021/dsa-4930refsupport.apple.com/kb/HT212601refseclists.org/fulldisclosure/2021/Jul/54refsecurity.netapp.com/advisory/ntap-20211104-0004