WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product libwebp✕
Overview 4 matches · 0 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
4matches 0in Waratek scope0.0% 0protected0.0% 1exploited25.0% 1CISA KEV25.0% 1public PoC25.0% 1EPSS ≥ 0.525.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 25.0% Not applicable 3 75.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 4 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 4 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 25.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 75.0%
split by peak 1 / quarter
Not applicable: 3Outside Waratek scope: 1 High: 4 not blocked: 4 No public exploit: 3Exploited: 1
Q2 191 Not applicable1 High1 not blocked1 No public exploit1 Q3 190 Q4 190 Q1 200 Q2 200 Q3 200 Q4 200 Q1 210 Q2 211 Not applicable1 High1 not blocked1 No public exploit1 Q3 210 Q4 210 Q1 220 Q2 220 Q3 220 Q4 220 Q1 230 Q2 231 Not applicable1 High1 not blocked1 No public exploit1 Q3 231 Outside Waratek scope1 High1 not blocked1 Exploited1
Q3 19Q1 20Q3 20Q1 21Q3 21Q1 22Q3 22Q1 23Q3 23
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-4863 High 2023-09-12 Outside Waratek scope Exploited Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
CVE-2023-1999 High 2023-06-20 Not applicable No public exploit There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.
CVE-2020-36332 High 2021-05-21 Not applicable No public exploit A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threat from this vulnerability is to the service availability.
CVE-2016-9969 High 2019-05-23 Not applicable No public exploit In libwebp 0.5.1, there is a double free bug in libwebpmux.