Google Assigns new CRITICAL CVE for 0day libwebp Vulnerability

September 27, 2023 by Namorgy

By Cyberkendra.com

TLDR: PLEASE UPDATE YOUR GOOGLE CHROME IMMEDIATELY

A critical zero-day vulnerability recently disclosed in the WebP image library also known as 0day in WebP poses a significant security risk across numerous software applications and platforms.

Originally reported by Apple and Citizen Lab which was tracked as CVE-2023-4863 specific to Google Chrome, now has since been reclassified as CVE-2023-5129 and correctly attributed as a flaw in libwebp with a maximum 10/10 severity rating.

By crafting malicious WebP images and getting victims to open them, attackers could leverage this bug to execute arbitrary code and access sensitive user data.

Ben Hawkes (former Project Zero manager) also wrote about this 0day, and he had this to say about it:

“The bad news is that Android is still likely affected. Similar to Apple’s ImageIO, Android has a facility called the BitmapFactory that handles image decoding, and of course libwebp is supported. As of today, Android hasn’t released a security bulletin that includes a fix for CVE-2023-4863 — although the fix has been merged into AOSP. To put this in context: if this bug does affect Android, then it could potentially be turned into a remote exploit for apps like Signal and WhatsApp. I’d expect it to be fixed in the October bulletin.”

Our Sponsor

www.Namorgy.com

Namorgy Network Solutions LLC
is dedicated to providing cost-effective IT Managed Services to small and midsize businesses that want to improve their productivity. With our comprehensive approach to Managed Services, we are your single source for all things IT, fully committed to customer service excellence. Our fast and friendly team of experts is always thinking ahead to deliver the best service possible.

Pete Groman
Namorgy Network Solutions GeekByTheWeek[TM]
pete@namorgy.com
972-454-0029

About ISpeakGeek.BIZ

Privacy and Disclosures:

Ispeakgeek .BIZ is a technology advocacy blog that is intended to help individuals and small businesses with understanding business technology. Most of the articles here are content derived from 3rd parties, including our sponsor. I speak geek .BIZ nor our sponsor makes no claims or warranties as to the veracity of the information. All content here in is provided as opinion. Your experience with these products or services may vary.

Your privacy is important to us. We do not record comments and therefore we do not require or record login information or use cookies or tracking information that could uniquely identify you. Unless you have freely given such information in a chat window, we do not have information on website visitors. Any information retained by our web host or stat counters is NOT sold or shared with any other 3rd party.

Advertisements displayed are generated by a 3rd party under their formula and control. I speak geek .BIZ does profit from their click-through, but has only loose control over subject matter categorically, and no control over detail or specific advertisers.

I speak geek .BIZ is affiliated with our sponsor: Namorgy Network Solutions LLC. Namorgy provides the hosting of the I speak geek.BIZ website. Therefore many of the articles here, though general in nature, or related to other 3rd party products, will offer contact information for Namorgy a point of contact for consulting.

Unless otherwise stated, I speak geek .BIZ is not affiliated with nor paid by any other third party or product. I do not receive cash or in-kind payment to review a product or service or for any of my endorsements.

These disclosures are posted as required by FTC ruling http://www.ftc.gov/opa/2009/10/endortest.shtm

Thank you.