Red Hat Product Errata RHSA-2021:2365 - Security Advisory
Issued:
2021-06-09
Updated:
2021-06-09

RHSA-2021:2365 - Security Advisory

Synopsis

Important: libwebp security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for libwebp is now available for Red Hat Enterprise Linux 8.1 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently.

Security Fix(es):

  • libwebp: heap-based buffer overflow in PutLE16() (CVE-2018-25011)
  • libwebp: heap-based buffer overflow in WebPDecode*Into functions (CVE-2020-36328)
  • libwebp: use-after-free in EmitFancyRGB() in dec/io_dec.c (CVE-2020-36329)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1 ppc64le
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.1 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.1 x86_64

Fixes

  • BZ - 1956829 - CVE-2020-36328 libwebp: heap-based buffer overflow in WebPDecode*Into functions
  • BZ - 1956843 - CVE-2020-36329 libwebp: use-after-free in EmitFancyRGB() in dec/io_dec.c
  • BZ - 1956919 - CVE-2018-25011 libwebp: heap-based buffer overflow in PutLE16()

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1

SRPM
libwebp-1.0.0-4.el8_1.src.rpm SHA-256: 6ee1ad64197ef15ef4603f9f9e94eb88996e30e3631936dbf79bd7585a01b60f
x86_64
libwebp-1.0.0-4.el8_1.i686.rpm SHA-256: d811e4d66eb96396b4047e07058dabd2d6e3cf8c755c00072bd04e44c892b117
libwebp-1.0.0-4.el8_1.x86_64.rpm SHA-256: d685a87786e2159eeed6c80c8f577a529650bb5a7358c72a15546b9648a0ca2b
libwebp-debuginfo-1.0.0-4.el8_1.i686.rpm SHA-256: 78f428aa70cb418f6cc2753a59b8a56894cd41e2e58e57f3df6a543fc11e077e
libwebp-debuginfo-1.0.0-4.el8_1.x86_64.rpm SHA-256: 39909e63b86212f1fde03c6cedb1a243540be287935b5fdeed7e12f6de09cd57
libwebp-debugsource-1.0.0-4.el8_1.i686.rpm SHA-256: 849d3d006bd1ccb711b8bff411005ec3b92337268c6c56a98737c0d30e305ee1
libwebp-debugsource-1.0.0-4.el8_1.x86_64.rpm SHA-256: 5a39bf2e85eb477d8c0f0e146b689cdd76d9780cc78920add37bfd40eb616bec
libwebp-devel-1.0.0-4.el8_1.i686.rpm SHA-256: 6c2cf49180ba3d897b52e3b969e414807130b0c6feb1ff99c304e5b98c696d3a
libwebp-devel-1.0.0-4.el8_1.x86_64.rpm SHA-256: 425420a319724bf52aa1fa150e894d0d22c2d9fcc9c8b5a12de5e3e67e3b31a4
libwebp-java-debuginfo-1.0.0-4.el8_1.i686.rpm SHA-256: 37319105bfaa040d6098dc1c72aed46986ec160a89619bb27afa78c987c42783
libwebp-java-debuginfo-1.0.0-4.el8_1.x86_64.rpm SHA-256: 0d499c7c7898fcf09f7fc3bae273cea6df8f0f9db6f5ee124bebd4de7fd30d2f
libwebp-tools-debuginfo-1.0.0-4.el8_1.i686.rpm SHA-256: b7c0b4056ea2e533f198b453d7773735368914f1b5a89929869951037ac82381
libwebp-tools-debuginfo-1.0.0-4.el8_1.x86_64.rpm SHA-256: 0d94b88e3f2d6cd1514fdf2ea86e565624b6218ce3437864289d30a272cfeae6

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1

SRPM
libwebp-1.0.0-4.el8_1.src.rpm SHA-256: 6ee1ad64197ef15ef4603f9f9e94eb88996e30e3631936dbf79bd7585a01b60f
s390x
libwebp-1.0.0-4.el8_1.s390x.rpm SHA-256: b405e9c9f037f6b3f8bb6ddea767f3d43df488d28d2b6b1b5e772e737f80296b
libwebp-debuginfo-1.0.0-4.el8_1.s390x.rpm SHA-256: b60683f22992c3fb9f894bc793a88786ee6a44145629945120de13e6b87de947
libwebp-debugsource-1.0.0-4.el8_1.s390x.rpm SHA-256: 626d1cd806baa512a38b10d7ea09dec76f426e0016eb6496e6216cb0c5cc05dd
libwebp-devel-1.0.0-4.el8_1.s390x.rpm SHA-256: 2204b23a8f4f883ef0deba6230363f1f59a669818bc28ff647819ec8e16d376a
libwebp-java-debuginfo-1.0.0-4.el8_1.s390x.rpm SHA-256: 549c1f2723e21e186db683f5eea54cbcff2cbd8c23921b85142039489818fa04
libwebp-tools-debuginfo-1.0.0-4.el8_1.s390x.rpm SHA-256: 4db59e84d6b978a0bbb23c2a006f689aebe49c78e0be699336e733af386179c5

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1

SRPM
libwebp-1.0.0-4.el8_1.src.rpm SHA-256: 6ee1ad64197ef15ef4603f9f9e94eb88996e30e3631936dbf79bd7585a01b60f
ppc64le
libwebp-1.0.0-4.el8_1.ppc64le.rpm SHA-256: c50dd24a7fde48f98a05d962722fbd8f89013fbf8b7eceeaedb793153b45a710
libwebp-debuginfo-1.0.0-4.el8_1.ppc64le.rpm SHA-256: b53eb0796b5bd05f3cebf76f927a01e1719a16edd3f55e6949e5d5fa29ae56d2
libwebp-debugsource-1.0.0-4.el8_1.ppc64le.rpm SHA-256: 20ee2684b0f51d12092a2989c7676f787c41d185210f8d4a97d940cd463ecb59
libwebp-devel-1.0.0-4.el8_1.ppc64le.rpm SHA-256: a28ff4fd1ffadb33d5e702165706f81c1f09b888741386b9494c2f946b8bba82
libwebp-java-debuginfo-1.0.0-4.el8_1.ppc64le.rpm SHA-256: db7dfd7f5c61eea13761a48836024c56033801f6d456a257ed8ee74038d3cd08
libwebp-tools-debuginfo-1.0.0-4.el8_1.ppc64le.rpm SHA-256: 8cd037351a03673868063e2770b5a8b7e3bacb1532942d98fbf7a7113953ac50

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1

SRPM
libwebp-1.0.0-4.el8_1.src.rpm SHA-256: 6ee1ad64197ef15ef4603f9f9e94eb88996e30e3631936dbf79bd7585a01b60f
aarch64
libwebp-1.0.0-4.el8_1.aarch64.rpm SHA-256: 45ff3036eecf139e6aae3034465eafd17f74eb61d5fab0ea7da2c67b1e476612
libwebp-debuginfo-1.0.0-4.el8_1.aarch64.rpm SHA-256: 7661b75be7f85d74ab9b91c7835dd806ded5a5882b3ae43cd9539bf330994f49
libwebp-debugsource-1.0.0-4.el8_1.aarch64.rpm SHA-256: a8671f59f839af8ffe3d1a1561c76d9544c7c5be59244f67c3cf49a4d0834ba3
libwebp-devel-1.0.0-4.el8_1.aarch64.rpm SHA-256: d4614a8c95cfa710e36caf2aa34c6c88ecb3936b578789cd4cab0263ed76b815
libwebp-java-debuginfo-1.0.0-4.el8_1.aarch64.rpm SHA-256: d1438a525f131193915f81af237d45090f45f80666b64bb5b43194b36a9bc482
libwebp-tools-debuginfo-1.0.0-4.el8_1.aarch64.rpm SHA-256: fef4264650f0f417107277a9d9a55af53b2f8c89b4d74a2f9c7786750a28ff5d

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.1

SRPM
libwebp-1.0.0-4.el8_1.src.rpm SHA-256: 6ee1ad64197ef15ef4603f9f9e94eb88996e30e3631936dbf79bd7585a01b60f
ppc64le
libwebp-1.0.0-4.el8_1.ppc64le.rpm SHA-256: c50dd24a7fde48f98a05d962722fbd8f89013fbf8b7eceeaedb793153b45a710
libwebp-debuginfo-1.0.0-4.el8_1.ppc64le.rpm SHA-256: b53eb0796b5bd05f3cebf76f927a01e1719a16edd3f55e6949e5d5fa29ae56d2
libwebp-debugsource-1.0.0-4.el8_1.ppc64le.rpm SHA-256: 20ee2684b0f51d12092a2989c7676f787c41d185210f8d4a97d940cd463ecb59
libwebp-devel-1.0.0-4.el8_1.ppc64le.rpm SHA-256: a28ff4fd1ffadb33d5e702165706f81c1f09b888741386b9494c2f946b8bba82
libwebp-java-debuginfo-1.0.0-4.el8_1.ppc64le.rpm SHA-256: db7dfd7f5c61eea13761a48836024c56033801f6d456a257ed8ee74038d3cd08
libwebp-tools-debuginfo-1.0.0-4.el8_1.ppc64le.rpm SHA-256: 8cd037351a03673868063e2770b5a8b7e3bacb1532942d98fbf7a7113953ac50

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.1

SRPM
libwebp-1.0.0-4.el8_1.src.rpm SHA-256: 6ee1ad64197ef15ef4603f9f9e94eb88996e30e3631936dbf79bd7585a01b60f
x86_64
libwebp-1.0.0-4.el8_1.i686.rpm SHA-256: d811e4d66eb96396b4047e07058dabd2d6e3cf8c755c00072bd04e44c892b117
libwebp-1.0.0-4.el8_1.x86_64.rpm SHA-256: d685a87786e2159eeed6c80c8f577a529650bb5a7358c72a15546b9648a0ca2b
libwebp-debuginfo-1.0.0-4.el8_1.i686.rpm SHA-256: 78f428aa70cb418f6cc2753a59b8a56894cd41e2e58e57f3df6a543fc11e077e
libwebp-debuginfo-1.0.0-4.el8_1.x86_64.rpm SHA-256: 39909e63b86212f1fde03c6cedb1a243540be287935b5fdeed7e12f6de09cd57
libwebp-debugsource-1.0.0-4.el8_1.i686.rpm SHA-256: 849d3d006bd1ccb711b8bff411005ec3b92337268c6c56a98737c0d30e305ee1
libwebp-debugsource-1.0.0-4.el8_1.x86_64.rpm SHA-256: 5a39bf2e85eb477d8c0f0e146b689cdd76d9780cc78920add37bfd40eb616bec
libwebp-devel-1.0.0-4.el8_1.i686.rpm SHA-256: 6c2cf49180ba3d897b52e3b969e414807130b0c6feb1ff99c304e5b98c696d3a
libwebp-devel-1.0.0-4.el8_1.x86_64.rpm SHA-256: 425420a319724bf52aa1fa150e894d0d22c2d9fcc9c8b5a12de5e3e67e3b31a4
libwebp-java-debuginfo-1.0.0-4.el8_1.i686.rpm SHA-256: 37319105bfaa040d6098dc1c72aed46986ec160a89619bb27afa78c987c42783
libwebp-java-debuginfo-1.0.0-4.el8_1.x86_64.rpm SHA-256: 0d499c7c7898fcf09f7fc3bae273cea6df8f0f9db6f5ee124bebd4de7fd30d2f
libwebp-tools-debuginfo-1.0.0-4.el8_1.i686.rpm SHA-256: b7c0b4056ea2e533f198b453d7773735368914f1b5a89929869951037ac82381
libwebp-tools-debuginfo-1.0.0-4.el8_1.x86_64.rpm SHA-256: 0d94b88e3f2d6cd1514fdf2ea86e565624b6218ce3437864289d30a272cfeae6

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.