Google confirms CVE-2023-5129 is the hidden threat in Libwebp

2023-09-28 By admin

Google’s recent confirmation of an exploited Chrome zero-day, CVE-2023-5129, has taken the cybersecurity world by storm.

This exploit has a ripple effect that extends beyond Chrome, affecting numerous popular applications that rely on the libwebp library for WebP image encoding/decoding.

Let’s delve into the details of CVE-2023-5129 and its implications.

CVE-2023-5129 was Initially linked to Chrome but it’s actually in Libwep

Understanding the impact of CVE-2023-5129

Initially, CVE-2023-5129 was identified as a distinct concern, but it was later rejected and withdrawn by Google’s CVE Numbering Authority, which deemed it a duplicate of CVE-2023-4863. This decision was accompanied by an expansion of CVE-2023-4863’s description, explicitly implicating the libwebp library.

CVE-2023-5129 stems from a flawed implementation of the Huffman coding algorithm, presenting attackers with an opportunity to trigger a heap buffer overflow and execute arbitrary code. The vulnerability affects libwebp versions 0.5.0 to 1.3.1, with a “perfect” CVSS score of 10.0, indicating its criticality.

CVE-2023-5129 had a wide impact, affecting numerous applications and systems that use the libwebp library. This includes popular browsers, Linux distributions, and cross-platform desktop apps. While some have already patched the vulnerability, others are still lagging behind, leaving their users exposed to potential threats.

Connecting the dots

Researchers have discovered connections between CVE-2023-41064, a buffer overflow vulnerability in the ImageI/O framework, CVE-2023-4863, the Chrome zero-day, and now CVE-2023-5129.

These findings suggest a common flaw exploited by various threats, highlighting the importance of addressing such vulnerabilities promptly.

The widespread use of the libwebp library makes it a prime target for attacks. As a result, it is essential for consumers to update their systems and software regularly to safeguard against CVE-2023-5129 and similar threats. This simple practice can prevent potential exploits and protect against future vulnerabilities.

CVE-2023-5129 has a critical CVSS score of 10.0

What is Libwebp?

Libwebp is an open-source library developed by Google that is used for encoding and decoding images in the WebP format. WebP is a modern image format that provides efficient compression and high-quality image rendering. Libwebp allows software developers to integrate WebP support into their applications, enabling the efficient handling of WebP images.

WebP is designed to be a versatile and lightweight image format suitable for a wide range of web-based applications. It offers both lossless and lossy compression options, making it adaptable for different use cases. Libwebp provides the necessary functionality to work with WebP images, including encoding images into the WebP format and decoding WebP images for display or processing.

Check the Electron-based apps ASAP

Tom Sellers, a principal research engineer, provides a useful shell command for macOS users to identify Electron-based apps with the necessary patches, ensuring their software is up to date.