Vulnerability Description
A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Webmproject | Libwebp | < 1.0.1 |
| Redhat | Enterprise Linux | 7.0 |
| Netapp | Ontap Select Deploy Administration Utility | - |
| Debian | Debian Linux | 9.0 |
| Apple | Ipados | 14.7 |
| Apple | Iphone Os | 14.7 |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2021/Jul/54Mailing ListThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1956829Issue TrackingPatchRelease Notes
- https://lists.debian.org/debian-lts-announce/2021/06/msg00005.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/06/msg00006.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20211112-0001/Third Party Advisory
- https://support.apple.com/kb/HT212601Third Party Advisory
- https://www.debian.org/security/2021/dsa-4930Third Party Advisory
- http://seclists.org/fulldisclosure/2021/Jul/54Mailing ListThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1956829Issue TrackingPatchRelease Notes
- https://lists.debian.org/debian-lts-announce/2021/06/msg00005.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/06/msg00006.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20211112-0001/Third Party Advisory
- https://support.apple.com/kb/HT212601Third Party Advisory
- https://www.debian.org/security/2021/dsa-4930Third Party Advisory
FAQ
What is CVE-2020-36328?
CVE-2020-36328 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vulne...
How severe is CVE-2020-36328?
CVE-2020-36328 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-36328?
Check the references section above for vendor advisories and patch information. Affected products include: Webmproject Libwebp, Redhat Enterprise Linux, Netapp Ontap Select Deploy Administration Utility, Debian Debian Linux, Apple Ipados.