CVE-2023-1999 is a security vulnerability affecting the WebP image format, specifically the libwebp software. With a severity rating of 7.5 (HIGH) according to NIST and 5.3 (MEDIUM) according to Google Inc., this vulnerability could potentially lead to remote code execution. Systems using affected versions of libwebp, particularly those running on Linux distributions like Gentoo, are at risk. It is recommended to update to the latest version of the software to mitigate this vulnerability.

How do I know if I'm affected?

If you're using the libwebp software from the WebM Project, you might be affected by the vulnerability. This issue impacts versions 0.4.2 up to, but not including, 1.3.1. To check if you're affected, you'll need to determine the version of libwebp you're using. Keep in mind that this vulnerability is particularly relevant for systems running on Linux distributions like Gentoo. Apple product versions are not mentioned in the available sources.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to update your libwebp software to the latest version. For Gentoo Linux users, run these commands in the terminal:

# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libwebp-1.3.1_p20230908"

By updating, you'll mitigate the risk of remote code execution and secure your system.

Is CVE-2023-1999 in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-1999 vulnerability, also known as a use after free/double free issue in libwebp, is not listed in CISA's Known Exploited Vulnerabilities Catalog. It was published on June 20, 2023, and affects the WebP image format. There is no specific due date or required action provided, but users are advised to update their libwebp software to the latest version to address the vulnerability and prevent potential remote code execution.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-416 (Use After Free) and CWE-415 (Double Free), which can lead to remote code execution in affected WebP software.

For more details

CVE-2023-1999 is a significant vulnerability affecting the WebP image format and libwebp software. Users should update their systems to mitigate the risk of remote code execution. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• libwebp Git Repository

• Gentoo Security Advisory