CVE-2023-1999: Use after free in libwebp
First published: Tue Apr 11 2023(Updated: )
<p>This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see <a href="https://chromereleases.googleblog.com/2023">Google Chrome Releases</a> for more information.</p>
Credit: cve-coordination@google.com cve-coordination@google.com cve-coordination@google.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox ESR | <102.10 | 102.10 |
| Microsoft Edge | <114.0.1823.67 | |
| Mozilla Thunderbird | <102.10 | 102.10 |
| Mozilla Firefox | <112 | 112 |
| All of | ||
| Mozilla Firefox | =112 | |
| Google Android | ||
| All of | ||
| Mozilla Focus | =112 | |
| Google Android | ||
| Microsoft Edge (Chromium-based) | ||
| Webmproject Libwebp | >=0.4.2<1.3.1 | |
| ubuntu/firefox | <112.0-1 | 112.0-1 |
| ubuntu/libwebp | <0.6.1-2ubuntu0.18.04.2 | 0.6.1-2ubuntu0.18.04.2 |
| ubuntu/libwebp | <0.6.1-2ubuntu0.20.04.2 | 0.6.1-2ubuntu0.20.04.2 |
| ubuntu/libwebp | <1.2.2-2ubuntu0.22.04.1 | 1.2.2-2ubuntu0.22.04.1 |
| ubuntu/libwebp | <1.2.2-2ubuntu0.22.10.1 | 1.2.2-2ubuntu0.22.10.1 |
| ubuntu/libwebp | <1.2.4-0.1ubuntu0.23.04.1 | 1.2.4-0.1ubuntu0.23.04.1 |
| ubuntu/libwebp | <1.2.4-0.1ubuntu1 | 1.2.4-0.1ubuntu1 |
| ubuntu/libwebp | <1.2.4-0.1ubuntu1 | 1.2.4-0.1ubuntu1 |
| ubuntu/libwebp | <0.4.4-1ubuntu0.1~ | 0.4.4-1ubuntu0.1~ |
| debian/firefox | 127.0.2-1 | |
| debian/firefox-esr | 115.12.0esr-1~deb11u1 115.12.0esr-1~deb12u1 115.12.0esr-1 | |
| debian/libwebp | 0.6.1-2.1+deb11u2 1.2.4-0.2+deb12u1 1.4.0-0.1 | |
| debian/thunderbird | 1:115.12.0-1~deb11u1 1:115.12.0-1~deb12u1 1:115.12.0-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://chromium.googlesource.com/webm/libwebp
- https://security.gentoo.org/glsa/202309-05
- https://launchpad.net/bugs/cve/CVE-2023-1999
- https://bugzilla.mozilla.org/show_bug.cgi?id=1819244
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-1999 (Advisory)
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-13/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-13/#CVE-2023-1999
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999
- https://ubuntu.com/security/notices/USN-6078-1
- https://ubuntu.com/security/notices/USN-6078-2
- https://www.cve.org/CVERecord?id=CVE-2023-1999
- https://nvd.nist.gov/vuln/detail/CVE-2023-1999
- https://security-tracker.debian.org/tracker/CVE-2023-1999
- https://hg.mozilla.org/releases/mozilla-esr102/rev/53b805c752ff23080e100eda2b3b4280d4370b2e
- https://github.com/webmproject/libwebp/commit/a486d800b60d0af4cc0836bf7ed8f21e12974129
- https://ubuntu.com/security/CVE-2023-1999
- https://chromium.googlesource.com/webm/libwebp/+/4654e1e7381044717d5d3e0dd7e735633a3ff300
- https://github.com/webmproject/libwebp/commit/187d379db68839f76d1390be291c471f2f66644c
- https://github.com/webmproject/libwebp/commit/5692eae1f3efd8b7b47398a9f5d74f1dc6f64e7f
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2023-29531
- CVE-2023-29532
- CVE-2023-29533
- CVE-2023-1999
- CVE-2023-29535
- CVE-2023-29536
- CVE-2023-29539
- CVE-2023-29541
- CVE-2023-29542
- CVE-2023-29545
- CVE-2023-1945
- CVE-2023-29548
- CVE-2023-29550
- CVE-2023-0547
- CVE-2023-29479
- CVE-2023-29534
- CVE-2023-29537
- CVE-2023-29538
- CVE-2023-29540
- CVE-2023-29543
- CVE-2023-29544
- CVE-2023-29546
- CVE-2023-29547
- CVE-2023-29549
- CVE-2023-29551
Frequently Asked Questions
What is CVE-2023-1999?
CVE-2023-1999 is a vulnerability that allows attackers to cause memory corruption and potentially exploitable crashes in libwebp due to a double-free vulnerability.
Is CVE-2023-1999 a high severity vulnerability?
Yes, CVE-2023-1999 is considered a high severity vulnerability.
Which software is affected by CVE-2023-1999?
The software affected by CVE-2023-1999 includes Thunderbird, Firefox, Firefox ESR, and libwebp.
How can I fix CVE-2023-1999?
To fix CVE-2023-1999, update your software to the latest version provided by the vendor.
Where can I find more information about CVE-2023-1999?
You can find more information about CVE-2023-1999 on the official CVE page and the bug tracking systems of Mozilla and Chromium.
- agent/weakness
- agent/type
- agent/remedy
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/mozilla-advisory
- agent/software-canonical-lookup-request
- collector/msrc
- source/Microsoft
- agent/software-canonical-lookup
- agent/author
- source/Mozilla
- collector/msrc-cve
- agent/description
- collector/nvd-cve
- source/NVD
- collector/nvd-api
- collector/nvd-index
- collector/usn-cve
- source/Ubuntu
- agent/references
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/severity
- agent/title
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- vendor/mozilla
- canonical/mozilla firefox esr
- vendor/microsoft
- canonical/microsoft edge
- canonical/mozilla thunderbird
- canonical/mozilla firefox
- version/mozilla firefox/112
- vendor/google
- canonical/google android
- canonical/mozilla focus
- version/mozilla focus/112
- canonical/microsoft edge (chromium-based)
- vendor/webmproject
- canonical/webmproject libwebp
- version/webmproject libwebp/0.4.2
- package-manager/ubuntu
- package-manager/debian