libwebp has critical cve-2023-4863

[A333]

There is a buffer overflow bug cve-2023-4863 in libwebp which is getting actively attacked in the wild (e.g. Chromium assigned this Critical severity).

According to my research gd uses libwebp and php-gd/libgd does not use the dynamically linked version from the libwebp package.

So I assume, that if libgd is vulnerable, it would still vulnerable if the libwebp package gets fixed.

So if libwebp is vulnerable it should be tracked separately from libwebp; and show e.g. on https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+bug/2035220

We use libgd, but security analysis showed our systems do won't handle webp files to gd, so we should not be vulnerable, but a lot of services would be.

I do not have the resources to code-dive/make a proof of concept. But I think it is critical that someone can rule out that cve-2023-4863 in php-gd / build against a patched version of libwebp; also e.g. for xenial.

[Mark Esler (eslerm)]

Thank you for the report A333!

I could not find the affected source code [0] in the xenial or mantic version of libgd2. Mantic does use libwebp-dev as a build dependency.

Does the php-gd package go by another name?

From Debian's codesearch [1] I am not seeing other affected packages.

I truly appreciate the check. Thank you.

[0] https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/4896.patch
[1] https://codesearch.debian.net/search?q=gstspu-pgs.c&literal=1

[Marc Deslauriers (mdeslaur)]

We have released an update for libwebp here:

https://ubuntu.com/security/notices/USN-6369-1

And I also verified libgd2, and can confirm it uses the system libwebp library.

[Marc Deslauriers (mdeslaur)]

Marking this bug as invalid, since there is nothing to do for libgd2.