by Kastro
Paper/Archive/CVE-2020-36331

CVE-2020-36331

redhat — A flaw was found in libwebp in versions before 1.0.1.

EPSS 2%CVSS 9.1
critical.is priorityof 100
44
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 83.3.833 × 2016.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability is to data confidentiality and to the service availability.

Affected

ProductAffectedFixed inSource
libwebplibwebp 1.0.1–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

refbugzilla.redhat.com/show_bug.cgi?id=1956856reflists.debian.org/debian-lts-announce/2021/06/msg00005.htmlreflists.debian.org/debian-lts-announce/2021/06/msg00006.htmladvisorydebian.org/security/2021/dsa-4930refsupport.apple.com/kb/HT212601refseclists.org/fulldisclosure/2021/Jul/54refsecurity.netapp.com/advisory/ntap-20211112-0001