WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product libwebp✕
Overview 14 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
14matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 14 100.0% Withdrawn CVE 0 0.0%
Critical 10 71.4% High 3 21.4% Medium 0 0.0% Low 1 7.1% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 14 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 14 100.0%
split by peak 11 / year
Not applicable: 14 Low: 1High: 3Critical: 10 not blocked: 14 No public exploit: 14
20171 Not applicable1 Low1 not blocked1 No public exploit1 20180 20191 Not applicable1 High1 not blocked1 No public exploit1 20200 202111 Not applicable11 Critical10 High1 not blocked11 No public exploit11 20220 20231 Not applicable1 High1 not blocked1 No public exploit1
2017201820192020202120222023
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-1999 High 2023-06-20 Not applicable No public exploit There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.
CVE-2020-36332 High 2021-05-21 Not applicable No public exploit A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threat from this vulnerability is to the service availability.
CVE-2020-36331 Critical 2021-05-21 Not applicable No public exploit A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability is to data confidentiality and to the service availability.
CVE-2020-36330 Critical 2021-05-21 Not applicable No public exploit A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the service availability.
CVE-2020-36329 Critical 2021-05-21 Not applicable No public exploit A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVE-2020-36328 Critical 2021-05-21 Not applicable No public exploit A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVE-2018-25014 Critical 2021-05-21 Not applicable No public exploit A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().
CVE-2018-25013 Critical 2021-05-21 Not applicable No public exploit A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes().
CVE-2018-25012 Critical 2021-05-21 Not applicable No public exploit A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24().
CVE-2018-25011 Critical 2021-05-21 Not applicable No public exploit A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16().
CVE-2018-25010 Critical 2021-05-21 Not applicable No public exploit A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().
CVE-2018-25009 Critical 2021-05-21 Not applicable No public exploit A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16().
CVE-2016-9969 High 2019-05-23 Not applicable No public exploit In libwebp 0.5.1, there is a double free bug in libwebpmux.
CVE-2016-9085 Low 2017-02-03 Not applicable No public exploit Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.