[de-users] CVE-2023-4863: Heap buffer overflow in libwebp - Angeblich auch LO betroffen !

Hallo *,

in beiden Artikeln (s.u.) ist auch LibreOffice als betroffene Software 
aufgeführt.

Weiß da jemand was ?
Wenn LO betroffen, ist Sicherheits-Update verfügbar ?
Ist LO-Nutzung dadurch ein Sicherheitsproblem ?

PATCHES für CVE-2023-4863 ( Heap buffer overflow in libweb ):

[A] Firefox 117.0.1 (64-Bit) ist gepatcht ( 
https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/ ).
[B] GIMP 2.10.34 Rev. 2 ist gepatcht ( https://www.gimp.org/downloads/ )

Grüße
Hans-Werner ;-))

[1] Critical WebP bug: many apps, not just browsers, under threat [ENG]

https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/

Update (9/13/2023):

So far the Web Browsers that have confirmed a fix and released an update 
include: Google Chrome[1], Mozilla Firefox[2], Brave[3], Microsoft 
Edge[4], and Tor Browser[5]. If your browser of choice is using Chromium 
then expect an update to already be rolled out or will be done shortly.

Important:

Let me make it perfectly clear that this vulnerability doesn't just 
affect web browsers, it affects any software that uses the libwebp 
library. This includes Electron-based applications, for example - 
Signal. Electron patched the vulnerability yesterday. Also, software 
like Honeyview (from Bandisoft) released an update to fix the issue. 
CVE-2023-4863 was falsely marked as Chrome-only by Mitre and other 
organizations that track CVE's and 100% of media reported this issue as 
"Chrome only", when it's not.

Who uses libwebp?

There are a lot of applications that use libwebp to render WebP images, 
I already mentioned a few of them, but some of the others that I know 
include: Affinity (the design software), Gimp, Inkscape, LibreOffice, 
Telegram, Thunderbird (now patched), ffmpeg, and many, many Android 
applications as well as cross-platform apps built with Flutter.

Update (9/14/2023):

1Password for Mac have released an update to address the issue. 
1Password (like many others) is an application built with Electron, and 
until all these apps upgrade to the latest version - they are considered 
vulnerable based on the severity of the bug.

[2] WebP-Schwachstelle betrifft zahlreiche Webbrowser und Apps [DEU]

https://www.golem.de/news/alles-patchen-webp-schwachstelle-betrifft-zahlreiche-webbrowser-und-apps-2309-177648.html


--
Liste abmelden mit E-Mail an: users+unsubscribe@de.libreoffice.org
Probleme? https://de.libreoffice.org/hilfe-kontakt/mailing-listen/abmeldung-liste/
Tipps zu Listenmails: https://wiki.documentfoundation.org/Netiquette/de
Listenarchiv: https://listarchives.libreoffice.org/de/users/
Datenschutzerklärung: https://www.documentfoundation.org/privacy