Bug 1389338 (CVE-2016-9085)

Summary: CVE-2016-9085 libwebp: Several integer overflows
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: abhgupta, ccoleman, dedgar, dmcphers, jgoulding, jialiu, joelsmith, jokerman, lmeyer, mmccomas, sardella, stransky, tiwillia, tuxator
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: libwebp 0.5.2 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-07-15 01:27:36 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1389339, 1389340, 1389341, 1389343, 1389345, 1857003    
Bug Blocks: 1856607    

Description Adam Mariš 2016-10-27 13:18:08 UTC
Multiple integer overflows were found in libwebp library.

Upstream patch:


CVE assignment:


Comment 2 Adam Mariš 2016-10-27 13:19:24 UTC
Created libwebp tracking bugs for this issue:

Affects: fedora-all [bug 1389340]
Affects: epel-6 [bug 1389343]

Comment 3 Adam Mariš 2016-10-27 13:19:34 UTC
Created mingw-libwebp tracking bugs for this issue:

Affects: fedora-all [bug 1389341]
Affects: epel-6 [bug 1389345]

Comment 4 Todd Cullum 2020-07-14 22:27:56 UTC
Flaw Summary:
libwebp includes an example program called gifdec.c which uses pointer arithmetic computations with integers. The affected routines are GIFReadFrame(), ClearRectangle(), and GIFBlendFrames(). The upstream patch uses wider size_t containers instead of integers in the calculations and also uses pointer increments in an attempt to avoid these integer overflows.

Versions of libwebp shipped with Red Hat Enterprise Linux 8 are affected but versions of libwebp shipped with all previous versions of Red Hat Enterprise Linux are not affected since the vulnerable code does not exist in those versions.

Comment 7 Todd Cullum 2020-07-14 22:41:26 UTC
Correction: the 1.0.0 version of libwebp shipped with Red Hat Enterprise Linux 8 is NOT affected as it includes the patch for this already.

Comment 8 Product Security DevOps Team 2020-07-15 01:27:36 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):