WebP: Multiple vulnerabilities — GLSA 201701-61

Multiple vulnerabilities have been discovered in WebP, the worst of which could allow a remote attacker to cause a Denial of Service condition.

Affected packages

media-libs/libwebp on all architectures
Affected versions < 0.5.2
Unaffected versions >= 0.5.2

Background

WebP is an image format employing both lossy and lossless compression.

Description

Multiple vulnerabilities have been discovered in WebP’s gif2webp tool. Please review the CVE identifier and bug reference for details.

Impact

A remote attacker, by enticing a user to process a specially crafted file using WebP’s gif2webp tool, could possibly cause a Denial of Service condition or other unspecified impacts.

Workaround

There is no known workaround at this time.

Resolution

All WebP users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=media-libs/libwebp-0.5.2"
 

References

Release date
January 24, 2017

Latest revision
January 24, 2017: 3

Severity
normal

Exploitable
remote

Bugzilla entries