var-202105-1461
Vulnerability from variot

A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. libwebp Is vulnerable to an out-of-bounds write.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Versions of libwebp prior to 1.0.1 have security vulnerabilities.

For the stable distribution (buster), these problems have been fixed in version 0.6.1-2+deb10u1.

We recommend that you upgrade your libwebp packages.

For the detailed security status of libwebp please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libwebp

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmDCfg0ACgkQEMKTtsN8 TjaaKBAAqMJfe5aH4Gh14SpB7h2S5JJUK+eo/aPo1tXn7BoLiF4O5g05+McyUOdE HI9ibolUfv+HoZlCDC93MBJvopWgd1/oqReHML5n2GXPBESYXpRstL04qwaRqu9g AvofhX88EwHefTXmljVTL4W1KgMJuhhPxVLdimxoqd0/hjagZtA7B7R05khigC5k nHMFoRogSPjI9H4vI2raYaOqC26zmrZNbk/CRVhuUbtDOG9qy9okjc+6KM9RcbXC ha++EhrGXPjCg5SwrQAZ50nW3Jwif2WpSeULfTrqHr2E8nHGUCHDMMtdDwegFH/X FK0dVaNPgrayw1Dji+fhBQz3qR7pl/1DK+gsLtREafxY0+AxZ57kCi51CykT/dLs eC4bOPaoho91KuLFrT+X/AyAASS/00VuroFJB4sWQUvEpBCnWPUW1m3NvjsyoYuj 0wmQMVM5Bb/aYuWAM+/V9MeoklmtIn+OPAXqsVvLxdbB0GScwJV86/NvsN6Nde6c twImfMCK1V75FPrIsxx37M52AYWvALgXbWoVi4aQPyPeDerQdgUPL1FzTGzem0NQ PnXhuE27H/pJz79DosW8md0RFr+tfPgZ8CeTirXSUUXFiqhcXR/w1lqN2vlmfm8V dmwgzvu9A7ZhG++JRqbbMx2D+NS4coGgRdA7XPuRrdNKniRIDhQ= =pN/j -----END PGP SIGNATURE----- . Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

All OpenShift Container Platform 4.6 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.6/updating/updating-cluster - -between-minor.html#understanding-upgrade-channels_updating-cluster-between - -minor

  1. Solution:

For OpenShift Container Platform 4.6 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-rel ease-notes.html

Details on how to access this content are available at https://docs.openshift.com/container-platform/4.6/updating/updating-cluster - -cli.html

  1. Bugs fixed (https://bugzilla.redhat.com/):

1813344 - CVE-2020-7598 nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or proto payload 1979134 - Placeholder bug for OCP 4.6.0 extras release

  1. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

===================================================================== Red Hat Security Advisory

Synopsis: Important: libwebp security update Advisory ID: RHSA-2021:2260-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:2260 Issue date: 2021-06-07 CVE Names: CVE-2018-25011 CVE-2020-36328 CVE-2020-36329 =====================================================================

  1. Summary:

An update for libwebp is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  1. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

  1. Description:

The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.

  1. Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

  1. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source: libwebp-0.3.0-10.el7_9.src.rpm

x86_64: libwebp-0.3.0-10.el7_9.i686.rpm libwebp-0.3.0-10.el7_9.x86_64.rpm libwebp-debuginfo-0.3.0-10.el7_9.i686.rpm libwebp-debuginfo-0.3.0-10.el7_9.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64: libwebp-debuginfo-0.3.0-10.el7_9.i686.rpm libwebp-debuginfo-0.3.0-10.el7_9.x86_64.rpm libwebp-devel-0.3.0-10.el7_9.i686.rpm libwebp-devel-0.3.0-10.el7_9.x86_64.rpm libwebp-java-0.3.0-10.el7_9.x86_64.rpm libwebp-tools-0.3.0-10.el7_9.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source: libwebp-0.3.0-10.el7_9.src.rpm

x86_64: libwebp-0.3.0-10.el7_9.i686.rpm libwebp-0.3.0-10.el7_9.x86_64.rpm libwebp-debuginfo-0.3.0-10.el7_9.i686.rpm libwebp-debuginfo-0.3.0-10.el7_9.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

x86_64: libwebp-debuginfo-0.3.0-10.el7_9.i686.rpm libwebp-debuginfo-0.3.0-10.el7_9.x86_64.rpm libwebp-devel-0.3.0-10.el7_9.i686.rpm libwebp-devel-0.3.0-10.el7_9.x86_64.rpm libwebp-java-0.3.0-10.el7_9.x86_64.rpm libwebp-tools-0.3.0-10.el7_9.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source: libwebp-0.3.0-10.el7_9.src.rpm

ppc64: libwebp-0.3.0-10.el7_9.ppc.rpm libwebp-0.3.0-10.el7_9.ppc64.rpm libwebp-debuginfo-0.3.0-10.el7_9.ppc.rpm libwebp-debuginfo-0.3.0-10.el7_9.ppc64.rpm

ppc64le: libwebp-0.3.0-10.el7_9.ppc64le.rpm libwebp-debuginfo-0.3.0-10.el7_9.ppc64le.rpm

s390x: libwebp-0.3.0-10.el7_9.s390.rpm libwebp-0.3.0-10.el7_9.s390x.rpm libwebp-debuginfo-0.3.0-10.el7_9.s390.rpm libwebp-debuginfo-0.3.0-10.el7_9.s390x.rpm

x86_64: libwebp-0.3.0-10.el7_9.i686.rpm libwebp-0.3.0-10.el7_9.x86_64.rpm libwebp-debuginfo-0.3.0-10.el7_9.i686.rpm libwebp-debuginfo-0.3.0-10.el7_9.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

ppc64: libwebp-debuginfo-0.3.0-10.el7_9.ppc.rpm libwebp-debuginfo-0.3.0-10.el7_9.ppc64.rpm libwebp-devel-0.3.0-10.el7_9.ppc.rpm libwebp-devel-0.3.0-10.el7_9.ppc64.rpm libwebp-java-0.3.0-10.el7_9.ppc64.rpm libwebp-tools-0.3.0-10.el7_9.ppc64.rpm

ppc64le: libwebp-debuginfo-0.3.0-10.el7_9.ppc64le.rpm libwebp-devel-0.3.0-10.el7_9.ppc64le.rpm libwebp-java-0.3.0-10.el7_9.ppc64le.rpm libwebp-tools-0.3.0-10.el7_9.ppc64le.rpm

s390x: libwebp-debuginfo-0.3.0-10.el7_9.s390.rpm libwebp-debuginfo-0.3.0-10.el7_9.s390x.rpm libwebp-devel-0.3.0-10.el7_9.s390.rpm libwebp-devel-0.3.0-10.el7_9.s390x.rpm libwebp-java-0.3.0-10.el7_9.s390x.rpm libwebp-tools-0.3.0-10.el7_9.s390x.rpm

x86_64: libwebp-debuginfo-0.3.0-10.el7_9.i686.rpm libwebp-debuginfo-0.3.0-10.el7_9.x86_64.rpm libwebp-devel-0.3.0-10.el7_9.i686.rpm libwebp-devel-0.3.0-10.el7_9.x86_64.rpm libwebp-java-0.3.0-10.el7_9.x86_64.rpm libwebp-tools-0.3.0-10.el7_9.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source: libwebp-0.3.0-10.el7_9.src.rpm

x86_64: libwebp-0.3.0-10.el7_9.i686.rpm libwebp-0.3.0-10.el7_9.x86_64.rpm libwebp-debuginfo-0.3.0-10.el7_9.i686.rpm libwebp-debuginfo-0.3.0-10.el7_9.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

x86_64: libwebp-debuginfo-0.3.0-10.el7_9.i686.rpm libwebp-debuginfo-0.3.0-10.el7_9.x86_64.rpm libwebp-devel-0.3.0-10.el7_9.i686.rpm libwebp-devel-0.3.0-10.el7_9.x86_64.rpm libwebp-java-0.3.0-10.el7_9.x86_64.rpm libwebp-tools-0.3.0-10.el7_9.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

  1. References:

https://access.redhat.com/security/cve/CVE-2018-25011 https://access.redhat.com/security/cve/CVE-2020-36328 https://access.redhat.com/security/cve/CVE-2020-36329 https://access.redhat.com/security/updates/classification/#important

  1. Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1

iQIVAwUBYL4OxtzjgjWX9erEAQi1Yw//ZajpWKH7bKTBXifw2DXrc61fOReKCwR9 sQ/djSkMMo+hwhFNtqq9zHDmI81tuOzBRgzA0FzA6qeNZGzsJmNX/RrNgnep9um7 X08Dvb6+5VuHWBrrBv26wV5wGq/t2VKgGXSoJi6CDDDRlLn/RiAJzuZqhdhp3Ijn xBHIDIEYoNTYoDvbvZUVhY1kRKJ2sr3UxjcWPqDCNZdu51Z8ssW5up/Uh3NaY8yv iB7PIoIHrtBD0nGQcy5h4qE47wFbe9RdLTOaqGDAGaOrHWWT56eC72YnCYKMxO4K 8X9EXjhEmmH4a4Pl4dND7D1wiiOQe5kSA8IhYdgHVZQyo9WBJTD6g6C5IERwwjat s3Z7vhzA+/cLEo8+Jc5orRGoLArU5rOl4uqh64AEPaON9UB8bMOnqm24y+Ebyi0B S+zZ2kQ1FGeQIMnrjAer3OUcVnf26e6qNWBK+HCjdfmbhgtZxTtXyOKcM4lSFVcm LY8pLMWzZpcSCpYh15YtRRCWr4bJyX1UD8V3l2Zzek9zmFq5ogVX78KBYV3c4oWn ReVMDEpXb3bYoV/EsMk7WOaDBKM1eU2OjVp2e7r2Fnt8GESxSpZ1pKegkxXdPnmX EmPhXKZNnwh4Z4Aw2AYIsQVo9QTyvCnZjfjAy9WfIqbyg8OTGJOeQqQLlKsq6ddb YXjUcIgJv2g= =kWSg -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . 7) - noarch

  1. Description:

The Qt Image Formats in an add-on module for the core Qt Gui library that provides support for additional image formats including MNG, TGA, TIFF, WBMP, and WebP. 8) - aarch64, ppc64le, s390x, x86_64

3

Show details on source website

To clipboard 

{
   "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
      affected_products: {
         "@id": "https://www.variotdbs.pl/ref/affected_products",
      },
      configurations: {
         "@id": "https://www.variotdbs.pl/ref/configurations",
      },
      credits: {
         "@id": "https://www.variotdbs.pl/ref/credits",
      },
      cvss: {
         "@id": "https://www.variotdbs.pl/ref/cvss/",
      },
      description: {
         "@id": "https://www.variotdbs.pl/ref/description/",
      },
      exploit_availability: {
         "@id": "https://www.variotdbs.pl/ref/exploit_availability/",
      },
      external_ids: {
         "@id": "https://www.variotdbs.pl/ref/external_ids/",
      },
      iot: {
         "@id": "https://www.variotdbs.pl/ref/iot/",
      },
      iot_taxonomy: {
         "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/",
      },
      patch: {
         "@id": "https://www.variotdbs.pl/ref/patch/",
      },
      problemtype_data: {
         "@id": "https://www.variotdbs.pl/ref/problemtype_data/",
      },
      references: {
         "@id": "https://www.variotdbs.pl/ref/references/",
      },
      sources: {
         "@id": "https://www.variotdbs.pl/ref/sources/",
      },
      sources_release_date: {
         "@id": "https://www.variotdbs.pl/ref/sources_release_date/",
      },
      sources_update_date: {
         "@id": "https://www.variotdbs.pl/ref/sources_update_date/",
      },
      threat_type: {
         "@id": "https://www.variotdbs.pl/ref/threat_type/",
      },
      title: {
         "@id": "https://www.variotdbs.pl/ref/title/",
      },
      type: {
         "@id": "https://www.variotdbs.pl/ref/type/",
      },
   },
   "@id": "https://www.variotdbs.pl/vuln/VAR-202105-1461",
   affected_products: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
            "@id": "https://www.variotdbs.pl/ref/sources",
         },
      },
      data: [
         {
            model: "ontap select deploy administration utility",
            scope: "eq",
            trust: 1,
            vendor: "netapp",
            version: null,
         },
         {
            model: "linux",
            scope: "eq",
            trust: 1,
            vendor: "debian",
            version: "10.0",
         },
         {
            model: "enterprise linux",
            scope: "eq",
            trust: 1,
            vendor: "redhat",
            version: "7.0",
         },
         {
            model: "enterprise linux",
            scope: "eq",
            trust: 1,
            vendor: "redhat",
            version: "8.0",
         },
         {
            model: "iphone os",
            scope: "eq",
            trust: 1,
            vendor: "apple",
            version: "14.7",
         },
         {
            model: "ipados",
            scope: "eq",
            trust: 1,
            vendor: "apple",
            version: "14.7",
         },
         {
            model: "linux",
            scope: "eq",
            trust: 1,
            vendor: "debian",
            version: "9.0",
         },
         {
            model: "libwebp",
            scope: "lt",
            trust: 1,
            vendor: "webmproject",
            version: "1.0.1",
         },
         {
            model: "libwebp",
            scope: null,
            trust: 0.8,
            vendor: "the webm",
            version: null,
         },
         {
            model: "gnu/linux",
            scope: null,
            trust: 0.8,
            vendor: "debian",
            version: null,
         },
         {
            model: "ontap select deploy administration utility",
            scope: null,
            trust: 0.8,
            vendor: "netapp",
            version: null,
         },
         {
            model: "red hat enterprise linux",
            scope: null,
            trust: 0.8,
            vendor: "レッドハット",
            version: null,
         },
         {
            model: "ipados",
            scope: null,
            trust: 0.8,
            vendor: "アップル",
            version: null,
         },
         {
            model: "ios",
            scope: null,
            trust: 0.8,
            vendor: "アップル",
            version: null,
         },
      ],
      sources: [
         {
            db: "JVNDB",
            id: "JVNDB-2018-016582",
         },
         {
            db: "NVD",
            id: "CVE-2020-36328",
         },
      ],
   },
   credits: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/credits#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "Red Hat",
      sources: [
         {
            db: "PACKETSTORM",
            id: "163504",
         },
         {
            db: "PACKETSTORM",
            id: "162998",
         },
         {
            db: "PACKETSTORM",
            id: "163028",
         },
         {
            db: "PACKETSTORM",
            id: "163029",
         },
         {
            db: "PACKETSTORM",
            id: "163058",
         },
         {
            db: "PACKETSTORM",
            id: "163061",
         },
      ],
      trust: 0.6,
   },
   cve: "CVE-2020-36328",
   cvss: {
      "@context": {
         cvssV2: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2",
         },
         cvssV3: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/",
         },
         severity: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/cvss/severity#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/severity",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
            "@id": "https://www.variotdbs.pl/ref/sources",
         },
      },
      data: [
         {
            cvssV2: [
               {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  author: "nvd@nist.gov",
                  availabilityImpact: "PARTIAL",
                  baseScore: 7.5,
                  confidentialityImpact: "PARTIAL",
                  exploitabilityScore: 10,
                  id: "CVE-2020-36328",
                  impactScore: 6.4,
                  integrityImpact: "PARTIAL",
                  severity: "HIGH",
                  trust: 1.9,
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                  version: "2.0",
               },
               {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  author: "VULHUB",
                  availabilityImpact: "PARTIAL",
                  baseScore: 7.5,
                  confidentialityImpact: "PARTIAL",
                  exploitabilityScore: 10,
                  id: "VHN-391907",
                  impactScore: 6.4,
                  integrityImpact: "PARTIAL",
                  severity: "HIGH",
                  trust: 0.1,
                  vectorString: "AV:N/AC:L/AU:N/C:P/I:P/A:P",
                  version: "2.0",
               },
            ],
            cvssV3: [
               {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  author: "nvd@nist.gov",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  exploitabilityScore: 3.9,
                  id: "CVE-2020-36328",
                  impactScore: 5.9,
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  trust: 1,
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               {
                  attackComplexity: "Low",
                  attackVector: "Network",
                  author: "NVD",
                  availabilityImpact: "High",
                  baseScore: 9.8,
                  baseSeverity: "Critical",
                  confidentialityImpact: "High",
                  exploitabilityScore: null,
                  id: "CVE-2020-36328",
                  impactScore: null,
                  integrityImpact: "High",
                  privilegesRequired: "None",
                  scope: "Unchanged",
                  trust: 0.8,
                  userInteraction: "None",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            ],
            severity: [
               {
                  author: "nvd@nist.gov",
                  id: "CVE-2020-36328",
                  trust: 1,
                  value: "CRITICAL",
               },
               {
                  author: "NVD",
                  id: "CVE-2020-36328",
                  trust: 0.8,
                  value: "Critical",
               },
               {
                  author: "CNNVD",
                  id: "CNNVD-202105-1380",
                  trust: 0.6,
                  value: "CRITICAL",
               },
               {
                  author: "VULHUB",
                  id: "VHN-391907",
                  trust: 0.1,
                  value: "HIGH",
               },
               {
                  author: "VULMON",
                  id: "CVE-2020-36328",
                  trust: 0.1,
                  value: "HIGH",
               },
            ],
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-391907",
         },
         {
            db: "VULMON",
            id: "CVE-2020-36328",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-016582",
         },
         {
            db: "CNNVD",
            id: "CNNVD-202105-1380",
         },
         {
            db: "NVD",
            id: "CVE-2020-36328",
         },
      ],
   },
   description: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/description#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. libwebp Is vulnerable to an out-of-bounds write.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Versions of libwebp prior to 1.0.1 have security vulnerabilities. \n\nFor the stable distribution (buster), these problems have been fixed in\nversion 0.6.1-2+deb10u1. \n\nWe recommend that you upgrade your libwebp packages. \n\nFor the detailed security status of libwebp please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/libwebp\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmDCfg0ACgkQEMKTtsN8\nTjaaKBAAqMJfe5aH4Gh14SpB7h2S5JJUK+eo/aPo1tXn7BoLiF4O5g05+McyUOdE\nHI9ibolUfv+HoZlCDC93MBJvopWgd1/oqReHML5n2GXPBESYXpRstL04qwaRqu9g\nAvofhX88EwHefTXmljVTL4W1KgMJuhhPxVLdimxoqd0/hjagZtA7B7R05khigC5k\nnHMFoRogSPjI9H4vI2raYaOqC26zmrZNbk/CRVhuUbtDOG9qy9okjc+6KM9RcbXC\nha++EhrGXPjCg5SwrQAZ50nW3Jwif2WpSeULfTrqHr2E8nHGUCHDMMtdDwegFH/X\nFK0dVaNPgrayw1Dji+fhBQz3qR7pl/1DK+gsLtREafxY0+AxZ57kCi51CykT/dLs\neC4bOPaoho91KuLFrT+X/AyAASS/00VuroFJB4sWQUvEpBCnWPUW1m3NvjsyoYuj\n0wmQMVM5Bb/aYuWAM+/V9MeoklmtIn+OPAXqsVvLxdbB0GScwJV86/NvsN6Nde6c\ntwImfMCK1V75FPrIsxx37M52AYWvALgXbWoVi4aQPyPeDerQdgUPL1FzTGzem0NQ\nPnXhuE27H/pJz79DosW8md0RFr+tfPgZ8CeTirXSUUXFiqhcXR/w1lqN2vlmfm8V\ndmwgzvu9A7ZhG++JRqbbMx2D+NS4coGgRdA7XPuRrdNKniRIDhQ=\n=pN/j\n-----END PGP SIGNATURE-----\n. Description:\n\nRed Hat OpenShift Container Platform is Red Hat's cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments. \n\nAll OpenShift Container Platform 4.6 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift Console\nor the CLI oc command. Instructions for upgrading a cluster are available\nat\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster\n- -between-minor.html#understanding-upgrade-channels_updating-cluster-between\n- -minor\n\n3. Solution:\n\nFor OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-rel\nease-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster\n- -cli.html\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1813344 - CVE-2020-7598 nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload\n1979134 - Placeholder bug for OCP 4.6.0 extras release\n\n5. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Important: libwebp security update\nAdvisory ID:       RHSA-2021:2260-01\nProduct:           Red Hat Enterprise Linux\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2021:2260\nIssue date:        2021-06-07\nCVE Names:         CVE-2018-25011 CVE-2020-36328 CVE-2020-36329 \n=====================================================================\n\n1. Summary:\n\nAn update for libwebp is now available for Red Hat Enterprise Linux 7. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Client (v. 7) - x86_64\nRed Hat Enterprise Linux Client Optional (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64\nRed Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Workstation (v. 7) - x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 7) - x86_64\n\n3. Description:\n\nThe libwebp packages provide a library and tools for the WebP graphics\nformat. WebP is an image format with a lossy compression of digital\nphotographic images. WebP consists of a codec based on the VP8 format, and\na container based on the Resource Interchange File Format (RIFF). \nWebmasters, web developers and browser developers can use WebP to compress,\narchive, and distribute digital images more efficiently. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Package List:\n\nRed Hat Enterprise Linux Client (v. 7):\n\nSource:\nlibwebp-0.3.0-10.el7_9.src.rpm\n\nx86_64:\nlibwebp-0.3.0-10.el7_9.i686.rpm\nlibwebp-0.3.0-10.el7_9.x86_64.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.i686.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.x86_64.rpm\n\nRed Hat Enterprise Linux Client Optional (v. 7):\n\nx86_64:\nlibwebp-debuginfo-0.3.0-10.el7_9.i686.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.x86_64.rpm\nlibwebp-devel-0.3.0-10.el7_9.i686.rpm\nlibwebp-devel-0.3.0-10.el7_9.x86_64.rpm\nlibwebp-java-0.3.0-10.el7_9.x86_64.rpm\nlibwebp-tools-0.3.0-10.el7_9.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode (v. 7):\n\nSource:\nlibwebp-0.3.0-10.el7_9.src.rpm\n\nx86_64:\nlibwebp-0.3.0-10.el7_9.i686.rpm\nlibwebp-0.3.0-10.el7_9.x86_64.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.i686.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode Optional (v. 7):\n\nx86_64:\nlibwebp-debuginfo-0.3.0-10.el7_9.i686.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.x86_64.rpm\nlibwebp-devel-0.3.0-10.el7_9.i686.rpm\nlibwebp-devel-0.3.0-10.el7_9.x86_64.rpm\nlibwebp-java-0.3.0-10.el7_9.x86_64.rpm\nlibwebp-tools-0.3.0-10.el7_9.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 7):\n\nSource:\nlibwebp-0.3.0-10.el7_9.src.rpm\n\nppc64:\nlibwebp-0.3.0-10.el7_9.ppc.rpm\nlibwebp-0.3.0-10.el7_9.ppc64.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.ppc.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.ppc64.rpm\n\nppc64le:\nlibwebp-0.3.0-10.el7_9.ppc64le.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.ppc64le.rpm\n\ns390x:\nlibwebp-0.3.0-10.el7_9.s390.rpm\nlibwebp-0.3.0-10.el7_9.s390x.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.s390.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.s390x.rpm\n\nx86_64:\nlibwebp-0.3.0-10.el7_9.i686.rpm\nlibwebp-0.3.0-10.el7_9.x86_64.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.i686.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 7):\n\nppc64:\nlibwebp-debuginfo-0.3.0-10.el7_9.ppc.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.ppc64.rpm\nlibwebp-devel-0.3.0-10.el7_9.ppc.rpm\nlibwebp-devel-0.3.0-10.el7_9.ppc64.rpm\nlibwebp-java-0.3.0-10.el7_9.ppc64.rpm\nlibwebp-tools-0.3.0-10.el7_9.ppc64.rpm\n\nppc64le:\nlibwebp-debuginfo-0.3.0-10.el7_9.ppc64le.rpm\nlibwebp-devel-0.3.0-10.el7_9.ppc64le.rpm\nlibwebp-java-0.3.0-10.el7_9.ppc64le.rpm\nlibwebp-tools-0.3.0-10.el7_9.ppc64le.rpm\n\ns390x:\nlibwebp-debuginfo-0.3.0-10.el7_9.s390.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.s390x.rpm\nlibwebp-devel-0.3.0-10.el7_9.s390.rpm\nlibwebp-devel-0.3.0-10.el7_9.s390x.rpm\nlibwebp-java-0.3.0-10.el7_9.s390x.rpm\nlibwebp-tools-0.3.0-10.el7_9.s390x.rpm\n\nx86_64:\nlibwebp-debuginfo-0.3.0-10.el7_9.i686.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.x86_64.rpm\nlibwebp-devel-0.3.0-10.el7_9.i686.rpm\nlibwebp-devel-0.3.0-10.el7_9.x86_64.rpm\nlibwebp-java-0.3.0-10.el7_9.x86_64.rpm\nlibwebp-tools-0.3.0-10.el7_9.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nlibwebp-0.3.0-10.el7_9.src.rpm\n\nx86_64:\nlibwebp-0.3.0-10.el7_9.i686.rpm\nlibwebp-0.3.0-10.el7_9.x86_64.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.i686.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 7):\n\nx86_64:\nlibwebp-debuginfo-0.3.0-10.el7_9.i686.rpm\nlibwebp-debuginfo-0.3.0-10.el7_9.x86_64.rpm\nlibwebp-devel-0.3.0-10.el7_9.i686.rpm\nlibwebp-devel-0.3.0-10.el7_9.x86_64.rpm\nlibwebp-java-0.3.0-10.el7_9.x86_64.rpm\nlibwebp-tools-0.3.0-10.el7_9.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2018-25011\nhttps://access.redhat.com/security/cve/CVE-2020-36328\nhttps://access.redhat.com/security/cve/CVE-2020-36329\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is <secalert@redhat.com>. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2021 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBYL4OxtzjgjWX9erEAQi1Yw//ZajpWKH7bKTBXifw2DXrc61fOReKCwR9\nsQ/djSkMMo+hwhFNtqq9zHDmI81tuOzBRgzA0FzA6qeNZGzsJmNX/RrNgnep9um7\nX08Dvb6+5VuHWBrrBv26wV5wGq/t2VKgGXSoJi6CDDDRlLn/RiAJzuZqhdhp3Ijn\nxBHIDIEYoNTYoDvbvZUVhY1kRKJ2sr3UxjcWPqDCNZdu51Z8ssW5up/Uh3NaY8yv\niB7PIoIHrtBD0nGQcy5h4qE47wFbe9RdLTOaqGDAGaOrHWWT56eC72YnCYKMxO4K\n8X9EXjhEmmH4a4Pl4dND7D1wiiOQe5kSA8IhYdgHVZQyo9WBJTD6g6C5IERwwjat\ns3Z7vhzA+/cLEo8+Jc5orRGoLArU5rOl4uqh64AEPaON9UB8bMOnqm24y+Ebyi0B\nS+zZ2kQ1FGeQIMnrjAer3OUcVnf26e6qNWBK+HCjdfmbhgtZxTtXyOKcM4lSFVcm\nLY8pLMWzZpcSCpYh15YtRRCWr4bJyX1UD8V3l2Zzek9zmFq5ogVX78KBYV3c4oWn\nReVMDEpXb3bYoV/EsMk7WOaDBKM1eU2OjVp2e7r2Fnt8GESxSpZ1pKegkxXdPnmX\nEmPhXKZNnwh4Z4Aw2AYIsQVo9QTyvCnZjfjAy9WfIqbyg8OTGJOeQqQLlKsq6ddb\nYXjUcIgJv2g=\n=kWSg\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n. 7) - noarch\n\n3. Description:\n\nThe Qt Image Formats in an add-on module for the core Qt Gui library that\nprovides support for additional image formats including MNG, TGA, TIFF,\nWBMP, and WebP. 8) - aarch64, ppc64le, s390x, x86_64\n\n3",
      sources: [
         {
            db: "NVD",
            id: "CVE-2020-36328",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-016582",
         },
         {
            db: "VULHUB",
            id: "VHN-391907",
         },
         {
            db: "VULMON",
            id: "CVE-2020-36328",
         },
         {
            db: "PACKETSTORM",
            id: "169076",
         },
         {
            db: "PACKETSTORM",
            id: "163504",
         },
         {
            db: "PACKETSTORM",
            id: "162998",
         },
         {
            db: "PACKETSTORM",
            id: "163028",
         },
         {
            db: "PACKETSTORM",
            id: "163029",
         },
         {
            db: "PACKETSTORM",
            id: "163058",
         },
         {
            db: "PACKETSTORM",
            id: "163061",
         },
      ],
      trust: 2.43,
   },
   external_ids: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            db: "NVD",
            id: "CVE-2020-36328",
            trust: 4.1,
         },
         {
            db: "PACKETSTORM",
            id: "163058",
            trust: 0.8,
         },
         {
            db: "PACKETSTORM",
            id: "163504",
            trust: 0.8,
         },
         {
            db: "PACKETSTORM",
            id: "163028",
            trust: 0.8,
         },
         {
            db: "PACKETSTORM",
            id: "162998",
            trust: 0.8,
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-016582",
            trust: 0.8,
         },
         {
            db: "CNNVD",
            id: "CNNVD-202105-1380",
            trust: 0.7,
         },
         {
            db: "CS-HELP",
            id: "SB2021090829",
            trust: 0.6,
         },
         {
            db: "CS-HELP",
            id: "SB2021072216",
            trust: 0.6,
         },
         {
            db: "CS-HELP",
            id: "SB2021061420",
            trust: 0.6,
         },
         {
            db: "CS-HELP",
            id: "SB2021060725",
            trust: 0.6,
         },
         {
            db: "CS-HELP",
            id: "SB2021060939",
            trust: 0.6,
         },
         {
            db: "CS-HELP",
            id: "SB2021071517",
            trust: 0.6,
         },
         {
            db: "PACKETSTORM",
            id: "163645",
            trust: 0.6,
         },
         {
            db: "AUSCERT",
            id: "ESB-2021.1965",
            trust: 0.6,
         },
         {
            db: "AUSCERT",
            id: "ESB-2021.2102",
            trust: 0.6,
         },
         {
            db: "AUSCERT",
            id: "ESB-2021.1880",
            trust: 0.6,
         },
         {
            db: "AUSCERT",
            id: "ESB-2021.1959",
            trust: 0.6,
         },
         {
            db: "AUSCERT",
            id: "ESB-2021.2485.2",
            trust: 0.6,
         },
         {
            db: "AUSCERT",
            id: "ESB-2021.2388",
            trust: 0.6,
         },
         {
            db: "AUSCERT",
            id: "ESB-2021.2036",
            trust: 0.6,
         },
         {
            db: "AUSCERT",
            id: "ESB-2021.2070",
            trust: 0.6,
         },
         {
            db: "PACKETSTORM",
            id: "163061",
            trust: 0.2,
         },
         {
            db: "PACKETSTORM",
            id: "163029",
            trust: 0.2,
         },
         {
            db: "VULHUB",
            id: "VHN-391907",
            trust: 0.1,
         },
         {
            db: "VULMON",
            id: "CVE-2020-36328",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "169076",
            trust: 0.1,
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-391907",
         },
         {
            db: "VULMON",
            id: "CVE-2020-36328",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-016582",
         },
         {
            db: "PACKETSTORM",
            id: "169076",
         },
         {
            db: "PACKETSTORM",
            id: "163504",
         },
         {
            db: "PACKETSTORM",
            id: "162998",
         },
         {
            db: "PACKETSTORM",
            id: "163028",
         },
         {
            db: "PACKETSTORM",
            id: "163029",
         },
         {
            db: "PACKETSTORM",
            id: "163058",
         },
         {
            db: "PACKETSTORM",
            id: "163061",
         },
         {
            db: "CNNVD",
            id: "CNNVD-202105-1380",
         },
         {
            db: "NVD",
            id: "CVE-2020-36328",
         },
      ],
   },
   id: "VAR-202105-1461",
   iot: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/iot#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: true,
      sources: [
         {
            db: "VULHUB",
            id: "VHN-391907",
         },
      ],
      trust: 0.01,
   },
   last_update_date: "2024-11-29T22:36:05.822000Z",
   patch: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/patch#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            title: "Bug 1956829",
            trust: 0.8,
            url: "https://lists.debian.org/debian-lts-announce/2021/06/msg00005.html",
         },
         {
            title: "libwebp Buffer error vulnerability fix",
            trust: 0.6,
            url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=151879",
         },
         {
            title: "Debian Security Advisories: DSA-4930-1 libwebp -- security update",
            trust: 0.1,
            url: "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=6dad0021173658916444dfc89f8d2495",
         },
      ],
      sources: [
         {
            db: "VULMON",
            id: "CVE-2020-36328",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-016582",
         },
         {
            db: "CNNVD",
            id: "CNNVD-202105-1380",
         },
      ],
   },
   problemtype_data: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            problemtype: "CWE-787",
            trust: 1.1,
         },
         {
            problemtype: "Out-of-bounds writing (CWE-787) [NVD Evaluation ]",
            trust: 0.8,
         },
         {
            problemtype: "CWE-119",
            trust: 0.1,
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-391907",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-016582",
         },
         {
            db: "NVD",
            id: "CVE-2020-36328",
         },
      ],
   },
   references: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/references#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            trust: 1.9,
            url: "https://www.debian.org/security/2021/dsa-4930",
         },
         {
            trust: 1.8,
            url: "https://support.apple.com/kb/ht212601",
         },
         {
            trust: 1.8,
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1956829",
         },
         {
            trust: 1.8,
            url: "https://lists.debian.org/debian-lts-announce/2021/06/msg00005.html",
         },
         {
            trust: 1.8,
            url: "https://lists.debian.org/debian-lts-announce/2021/06/msg00006.html",
         },
         {
            trust: 1.7,
            url: "https://security.netapp.com/advisory/ntap-20211112-0001/",
         },
         {
            trust: 1.7,
            url: "http://seclists.org/fulldisclosure/2021/jul/54",
         },
         {
            trust: 1.5,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-36328",
         },
         {
            trust: 0.7,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-36329",
         },
         {
            trust: 0.7,
            url: "https://nvd.nist.gov/vuln/detail/cve-2018-25011",
         },
         {
            trust: 0.6,
            url: "https://listman.redhat.com/mailman/listinfo/rhsa-announce",
         },
         {
            trust: 0.6,
            url: "https://access.redhat.com/security/cve/cve-2020-36329",
         },
         {
            trust: 0.6,
            url: "https://access.redhat.com/security/team/contact/",
         },
         {
            trust: 0.6,
            url: "https://access.redhat.com/security/cve/cve-2020-36328",
         },
         {
            trust: 0.6,
            url: "https://access.redhat.com/security/cve/cve-2018-25011",
         },
         {
            trust: 0.6,
            url: "https://bugzilla.redhat.com/):",
         },
         {
            trust: 0.6,
            url: "https://www.auscert.org.au/bulletins/esb-2021.1959",
         },
         {
            trust: 0.6,
            url: "https://packetstormsecurity.com/files/163028/red-hat-security-advisory-2021-2328-01.html",
         },
         {
            trust: 0.6,
            url: "https://www.cybersecurity-help.cz/vdb/sb2021060725",
         },
         {
            trust: 0.6,
            url: "https://vigilance.fr/vulnerability/libwebp-five-vulnerabilities-35580",
         },
         {
            trust: 0.6,
            url: "https://www.auscert.org.au/bulletins/esb-2021.2485.2",
         },
         {
            trust: 0.6,
            url: "https://www.auscert.org.au/bulletins/esb-2021.1965",
         },
         {
            trust: 0.6,
            url: "https://packetstormsecurity.com/files/163504/red-hat-security-advisory-2021-2643-01.html",
         },
         {
            trust: 0.6,
            url: "https://www.cybersecurity-help.cz/vdb/sb2021072216",
         },
         {
            trust: 0.6,
            url: "https://packetstormsecurity.com/files/162998/red-hat-security-advisory-2021-2260-01.html",
         },
         {
            trust: 0.6,
            url: "https://packetstormsecurity.com/files/163058/red-hat-security-advisory-2021-2365-01.html",
         },
         {
            trust: 0.6,
            url: "https://support.apple.com/en-us/ht212601",
         },
         {
            trust: 0.6,
            url: "https://www.cybersecurity-help.cz/vdb/sb2021060939",
         },
         {
            trust: 0.6,
            url: "https://www.auscert.org.au/bulletins/esb-2021.1880",
         },
         {
            trust: 0.6,
            url: "https://www.cybersecurity-help.cz/vdb/sb2021061420",
         },
         {
            trust: 0.6,
            url: "https://www.cybersecurity-help.cz/vdb/sb2021071517",
         },
         {
            trust: 0.6,
            url: "https://packetstormsecurity.com/files/163645/apple-security-advisory-2021-07-21-1.html",
         },
         {
            trust: 0.6,
            url: "https://www.auscert.org.au/bulletins/esb-2021.2036",
         },
         {
            trust: 0.6,
            url: "https://www.auscert.org.au/bulletins/esb-2021.2102",
         },
         {
            trust: 0.6,
            url: "https://www.auscert.org.au/bulletins/esb-2021.2388",
         },
         {
            trust: 0.6,
            url: "https://www.auscert.org.au/bulletins/esb-2021.2070",
         },
         {
            trust: 0.6,
            url: "https://www.cybersecurity-help.cz/vdb/sb2021090829",
         },
         {
            trust: 0.5,
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            trust: 0.5,
            url: "https://access.redhat.com/articles/11258",
         },
         {
            trust: 0.5,
            url: "https://access.redhat.com/security/team/key/",
         },
         {
            trust: 0.2,
            url: "https://nvd.nist.gov/vuln/detail/cve-2018-25014",
         },
         {
            trust: 0.1,
            url: "https://cwe.mitre.org/data/definitions/787.html",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-36332",
         },
         {
            trust: 0.1,
            url: "https://www.debian.org/security/faq",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2018-25010",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-36330",
         },
         {
            trust: 0.1,
            url: "https://security-tracker.debian.org/tracker/libwebp",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-36331",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2018-25013",
         },
         {
            trust: 0.1,
            url: "https://www.debian.org/security/",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2018-25009",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/security/cve/cve-2021-3583",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-7598",
         },
         {
            trust: 0.1,
            url: "https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-rel",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/security/cve/cve-2021-3570",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/errata/rhba-2021:2641",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/security/cve/cve-2020-7598",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/errata/rhsa-2021:2643",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2021-3570",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2021-3583",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/security/updates/classification/#moderate",
         },
         {
            trust: 0.1,
            url: "https://docs.openshift.com/container-platform/4.6/updating/updating-cluster",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/errata/rhsa-2021:2260",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/errata/rhsa-2021:2328",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/security/cve/cve-2018-25014",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/errata/rhsa-2021:2354",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/errata/rhsa-2021:2365",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/errata/rhsa-2021:2364",
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-391907",
         },
         {
            db: "VULMON",
            id: "CVE-2020-36328",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-016582",
         },
         {
            db: "PACKETSTORM",
            id: "169076",
         },
         {
            db: "PACKETSTORM",
            id: "163504",
         },
         {
            db: "PACKETSTORM",
            id: "162998",
         },
         {
            db: "PACKETSTORM",
            id: "163028",
         },
         {
            db: "PACKETSTORM",
            id: "163029",
         },
         {
            db: "PACKETSTORM",
            id: "163058",
         },
         {
            db: "PACKETSTORM",
            id: "163061",
         },
         {
            db: "CNNVD",
            id: "CNNVD-202105-1380",
         },
         {
            db: "NVD",
            id: "CVE-2020-36328",
         },
      ],
   },
   sources: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            db: "VULHUB",
            id: "VHN-391907",
         },
         {
            db: "VULMON",
            id: "CVE-2020-36328",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-016582",
         },
         {
            db: "PACKETSTORM",
            id: "169076",
         },
         {
            db: "PACKETSTORM",
            id: "163504",
         },
         {
            db: "PACKETSTORM",
            id: "162998",
         },
         {
            db: "PACKETSTORM",
            id: "163028",
         },
         {
            db: "PACKETSTORM",
            id: "163029",
         },
         {
            db: "PACKETSTORM",
            id: "163058",
         },
         {
            db: "PACKETSTORM",
            id: "163061",
         },
         {
            db: "CNNVD",
            id: "CNNVD-202105-1380",
         },
         {
            db: "NVD",
            id: "CVE-2020-36328",
         },
      ],
   },
   sources_release_date: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            date: "2021-05-21T00:00:00",
            db: "VULHUB",
            id: "VHN-391907",
         },
         {
            date: "2021-05-21T00:00:00",
            db: "VULMON",
            id: "CVE-2020-36328",
         },
         {
            date: "2022-01-27T00:00:00",
            db: "JVNDB",
            id: "JVNDB-2018-016582",
         },
         {
            date: "2021-06-28T19:12:00",
            db: "PACKETSTORM",
            id: "169076",
         },
         {
            date: "2021-07-14T15:29:37",
            db: "PACKETSTORM",
            id: "163504",
         },
         {
            date: "2021-06-07T13:58:06",
            db: "PACKETSTORM",
            id: "162998",
         },
         {
            date: "2021-06-09T13:21:49",
            db: "PACKETSTORM",
            id: "163028",
         },
         {
            date: "2021-06-09T13:22:14",
            db: "PACKETSTORM",
            id: "163029",
         },
         {
            date: "2021-06-10T13:39:19",
            db: "PACKETSTORM",
            id: "163058",
         },
         {
            date: "2021-06-10T13:42:06",
            db: "PACKETSTORM",
            id: "163061",
         },
         {
            date: "2021-05-21T00:00:00",
            db: "CNNVD",
            id: "CNNVD-202105-1380",
         },
         {
            date: "2021-05-21T17:15:08.270000",
            db: "NVD",
            id: "CVE-2020-36328",
         },
      ],
   },
   sources_update_date: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            date: "2023-01-09T00:00:00",
            db: "VULHUB",
            id: "VHN-391907",
         },
         {
            date: "2021-07-23T00:00:00",
            db: "VULMON",
            id: "CVE-2020-36328",
         },
         {
            date: "2022-01-27T09:07:00",
            db: "JVNDB",
            id: "JVNDB-2018-016582",
         },
         {
            date: "2021-11-15T00:00:00",
            db: "CNNVD",
            id: "CNNVD-202105-1380",
         },
         {
            date: "2023-01-09T16:41:59.350000",
            db: "NVD",
            id: "CVE-2020-36328",
         },
      ],
   },
   threat_type: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "remote",
      sources: [
         {
            db: "CNNVD",
            id: "CNNVD-202105-1380",
         },
      ],
      trust: 0.6,
   },
   title: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/title#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "libwebp  Out-of-bounds Vulnerability in Microsoft",
      sources: [
         {
            db: "JVNDB",
            id: "JVNDB-2018-016582",
         },
      ],
      trust: 0.8,
   },
   type: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/type#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "buffer error",
      sources: [
         {
            db: "CNNVD",
            id: "CNNVD-202105-1380",
         },
      ],
      trust: 0.6,
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.