CVE-2020-36330: Buffer Overflow
First published: Tue May 04 2021(Updated: )
A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the service availability.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/libwebp | 0.6.1-2+deb10u1 0.6.1-2+deb10u3 0.6.1-2.1+deb11u2 1.2.4-0.2+deb12u1 1.3.2-0.3 | |
| Webmproject Libwebp | <1.0.1 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| Redhat Enterprise Linux | =8.0 | |
| NetApp ONTAP Select Deploy administration utility | ||
| Apple iPadOS | <14.7 | |
| Apple iPhone OS | <14.7 | |
| redhat/libwebp | <1.0.1 | 1.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.chromium.org/p/webp/issues/detail?id=386
- https://chromium.googlesource.com/webm/libwebp/+/2c70ad76c94db5427d37ab4b85dc89b94dd75e01
- https://security-tracker.debian.org/tracker/CVE-2020-36330
- http://seclists.org/fulldisclosure/2021/Jul/54
- https://bugzilla.redhat.com/show_bug.cgi?id=1956853
- https://lists.debian.org/debian-lts-announce/2021/06/msg00005.html
- https://lists.debian.org/debian-lts-announce/2021/06/msg00006.html
- https://security.netapp.com/advisory/ntap-20211104-0004/
- https://support.apple.com/kb/HT212601
- https://www.debian.org/security/2021/dsa-4930
- https://access.redhat.com/errata/RHSA-2021:4231
- https://access.redhat.com/security/cve/cve-2020-36330
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-36330.
What is the severity of CVE-2020-36330?
The severity of CVE-2020-36330 is critical with a CVSS score of 9.1.
What is the affected software?
The affected software includes libwebp in versions before 1.0.1, Mozilla Firefox ESR, Debian Linux, Redhat Enterprise Linux, NetApp ONTAP Select Deploy administration utility, Apple iPadOS, and Apple iPhone OS.
What is the highest threat from CVE-2020-36330?
The highest threat from CVE-2020-36330 is to data confidentiality and service availability.
How can I fix CVE-2020-36330?
To fix CVE-2020-36330, update to version 1.0.1 or later of libwebp.
- collector/security-tracker-debian
- agent/type
- agent/references
- agent/weakness
- agent/remedy
- agent/severity
- agent/author
- agent/description
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-36330
- agent/software-canonical-lookup
- package-manager/debian
- vendor/webmproject
- canonical/webmproject libwebp
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0
- vendor/netapp
- canonical/netapp ontap select deploy administration utility
- vendor/apple
- canonical/apple ipados
- canonical/apple iphone os
- package-manager/redhat