GHSA-4vjr-crvh-383h: Buffer Overflow
First published: Wed Sep 27 2023(Updated: )
### Impact Heap buffer overflow in `libwebp` allows a remote attacker to perform an out of bounds memory write via a crafted webp image. ### References - https://github.com/advisories/GHSA-j7hp-h8jx-5ppr - https://blog.isosceles.com/the-webp-0day/
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/@napi-rs/image | <1.7.0 | 1.7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/Brooooooklyn/Image/security/advisories/GHSA-4vjr-crvh-383h
- https://github.com/Brooooooklyn/Image/commit/aa07979f6cd0c534a8befea87fac1210a3b621c1
- https://blog.isosceles.com/the-webp-0day/
- https://github.com/Brooooooklyn/Image/releases/tag/%40napi-rs%2Fimage%401.7.0
- https://github.com/advisories/GHSA-j7hp-h8jx-5ppr
- https://github.com/advisories/GHSA-4vjr-crvh-383h (Advisory)
Frequently Asked Questions
What is the impact of GHSA-4vjr-crvh-383h?
GHSA-4vjr-crvh-383h allows a remote attacker to perform an out of bounds memory write via a crafted webp image.
How can GHSA-4vjr-crvh-383h be exploited?
GHSA-4vjr-crvh-383h can be exploited by sending a crafted webp image to the vulnerable application.
What is the severity of GHSA-4vjr-crvh-383h?
The severity of GHSA-4vjr-crvh-383h is high with a CVSS score of 8.8.
Is there a fix for GHSA-4vjr-crvh-383h?
Yes, updating to version 1.7.0 of the @napi-rs/image package will fix GHSA-4vjr-crvh-383h.
Can you provide more information about GHSA-4vjr-crvh-383h?
For more information about GHSA-4vjr-crvh-383h, you can refer to the GitHub advisory and commit links provided.
- collector/github-advisory-latest
- alias/GHSA-4vjr-crvh-383h
- collector/github-advisory
- agent/severity
- agent/references
- agent/weakness
- agent/type
- agent/tags
- agent/event
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- package-manager/npm