Joined: 12 May 2004
|Posted: Wed Dec 25, 2013 11:04 am Post subject: [ GLSA 201312-08 ] WebP: User-assisted execution of arbitrar
|Gentoo Linux Security Advisory
Title: WebP: User-assisted execution of arbitrary code (GLSA 201312-08)
Date: December 10, 2013
An integer overflow vulnerability in WebP could lead to arbitrary
code execution or Denial of Service.
WebP is a lossy image compression format.
Vulnerable: < 0.2.1
Unaffected: >= 0.2.1
Architectures: All supported architectures
An integer overflow flaw has been found in WebP.
A remote attacker could entice a user to open a specially crafted image
in an application linked against WebP, possibly resulting in execution of
arbitrary code with the privileges of the process or a Denial of Service
There is no known workaround at this time.
All WebP users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/libwebp-0.2.1"