https://pwn.watch/t/libwebp Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Wed, 13 Sep 2023 00:00:00 GMT https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863 https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863 Wed, 13 Sep 2023 00:00:00 GMT high <p>A heap overflow in libwebp's lossless decoder, found by Apple SEAR and Citizen Lab after the BLASTPASS iPhone exploit, was exploited in the wild. Because libwebp is everywhere, browsers, Electron apps and image libraries that bundle it all had to ship updates.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> Chrome 116.0.5845.187, libwebp 1.3.2, Bundling apps/libraries: see each vendor's advisory</p> <p><strong>Latest updates:</strong></p><ul><li>2023-09-13: CISA adds CVE-2023-4863 to the KEV catalog</li><li>2023-09-11: Chrome stable update fixes CVE-2023-4863; Google says an exploit exists in the wild (<a href="https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2023-4863</p>