There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.
{ "binaries": [ { "binary_version": "0.4.0-4ubuntu0.1~esm1", "binary_name": "libwebp-dev" }, { "binary_version": "0.4.0-4ubuntu0.1~esm1", "binary_name": "libwebp5" }, { "binary_version": "0.4.0-4ubuntu0.1~esm1", "binary_name": "libwebpdemux1" }, { "binary_version": "0.4.0-4ubuntu0.1~esm1", "binary_name": "libwebpmux1" }, { "binary_version": "0.4.0-4ubuntu0.1~esm1", "binary_name": "webp" } ] }
{ "binaries": [ { "binary_version": "0.4.4-1ubuntu0.1~esm2", "binary_name": "libwebp-dev" }, { "binary_version": "0.4.4-1ubuntu0.1~esm2", "binary_name": "libwebp5" }, { "binary_version": "0.4.4-1ubuntu0.1~esm2", "binary_name": "libwebpdemux1" }, { "binary_version": "0.4.4-1ubuntu0.1~esm2", "binary_name": "libwebpmux1" }, { "binary_version": "0.4.4-1ubuntu0.1~esm2", "binary_name": "webp" } ], "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro" }
{ "binaries": [ { "binary_version": "0.6.1-2ubuntu0.18.04.2", "binary_name": "libwebp-dev" }, { "binary_version": "0.6.1-2ubuntu0.18.04.2", "binary_name": "libwebp6" }, { "binary_version": "0.6.1-2ubuntu0.18.04.2", "binary_name": "libwebpdemux2" }, { "binary_version": "0.6.1-2ubuntu0.18.04.2", "binary_name": "libwebpmux3" }, { "binary_version": "0.6.1-2ubuntu0.18.04.2", "binary_name": "webp" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_version": "0.6.1-2ubuntu0.20.04.2", "binary_name": "libwebp-dev" }, { "binary_version": "0.6.1-2ubuntu0.20.04.2", "binary_name": "libwebp6" }, { "binary_version": "0.6.1-2ubuntu0.20.04.2", "binary_name": "libwebpdemux2" }, { "binary_version": "0.6.1-2ubuntu0.20.04.2", "binary_name": "libwebpmux3" }, { "binary_version": "0.6.1-2ubuntu0.20.04.2", "binary_name": "webp" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_version": "1.2.2-2ubuntu0.22.04.1", "binary_name": "libwebp-dev" }, { "binary_version": "1.2.2-2ubuntu0.22.04.1", "binary_name": "libwebp7" }, { "binary_version": "1.2.2-2ubuntu0.22.04.1", "binary_name": "libwebpdemux2" }, { "binary_version": "1.2.2-2ubuntu0.22.04.1", "binary_name": "libwebpmux3" }, { "binary_version": "1.2.2-2ubuntu0.22.04.1", "binary_name": "webp" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_version": "1:128.12.0+build1-0ubuntu0.22.04.1", "binary_name": "thunderbird" }, { "binary_version": "1:128.12.0+build1-0ubuntu0.22.04.1", "binary_name": "thunderbird-dev" }, { "binary_version": "1:128.12.0+build1-0ubuntu0.22.04.1", "binary_name": "thunderbird-gnome-support" }, { "binary_version": "1:128.12.0+build1-0ubuntu0.22.04.1", "binary_name": "thunderbird-mozsymbols" }, { "binary_version": "1:128.12.0+build1-0ubuntu0.22.04.1", "binary_name": "xul-ext-calendar-timezones" }, { "binary_version": "1:128.12.0+build1-0ubuntu0.22.04.1", "binary_name": "xul-ext-gdata-provider" }, { "binary_version": "1:128.12.0+build1-0ubuntu0.22.04.1", "binary_name": "xul-ext-lightning" } ] }