CVE-2023-1999: Use after free in libwebp
A double-free in libwebp could have led to memory corruption and a potentially exploitable crash.
Other sources
Chromium: CVE-2023-1999 Use after free in libwebp
— Microsoft
There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.
— Ubuntu
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2023-29531
- CVE-2023-29532
- CVE-2023-29533
- CVE-2023-1999
- CVE-2023-29535
- CVE-2023-29536
- CVE-2023-0547
- CVE-2023-29479
- CVE-2023-29539
- CVE-2023-29541
- CVE-2023-29542
- CVE-2023-29545
- CVE-2023-1945
- CVE-2023-29548
- CVE-2023-29550
- CVE-2023-29534
- CVE-2023-29537
- CVE-2023-29538
- CVE-2023-29540
- CVE-2023-29543
- CVE-2023-29544
- CVE-2023-29546
- CVE-2023-29547
- CVE-2023-29549
- CVE-2023-29551
Frequently Asked Questions
What is CVE-2023-1999?
CVE-2023-1999 is a vulnerability that allows attackers to cause memory corruption and potentially exploitable crashes in libwebp due to a double-free vulnerability.
Is CVE-2023-1999 a high severity vulnerability?
Yes, CVE-2023-1999 is considered a high severity vulnerability.
Which software is affected by CVE-2023-1999?
The software affected by CVE-2023-1999 includes Thunderbird, Firefox, Firefox ESR, and libwebp.
How can I fix CVE-2023-1999?
To fix CVE-2023-1999, update your software to the latest version provided by the vendor.
Where can I find more information about CVE-2023-1999?
You can find more information about CVE-2023-1999 on the official CVE page and the bug tracking systems of Mozilla and Chromium.