CVE-2020-36331

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability is to data confidentiality and to the service availability.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	libwebp	libwebp 1.0.1

References

http://seclists.org/fulldisclosure/2021/Jul/54Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1956856Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00005.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00006.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20211112-0001/Third Party Advisory
https://support.apple.com/kb/HT212601Third Party Advisory
https://www.debian.org/security/2021/dsa-4930Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2021/Jul/54Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1956856Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00005.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00006.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20211112-0001/Third Party Advisory
https://support.apple.com/kb/HT212601Third Party Advisory
https://www.debian.org/security/2021/dsa-4930Mailing List, Third Party Advisory

Timeline

Published: May 21, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-363327.5A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threa CVE-2020-363339.1themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizard_actions hook.CVE-2020-363348.8themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database.CVE-2020-36349.1u'Multiple Read overflows issue due to improper length check while decoding Generic NAS transport/EMM info' in Snapdragon Auto, Snapdragon C CVE-2020-36357.8Stack based overflow If the maximum number of arguments allowed per request in perflock exceeds in Snapdragon Auto, Snapdragon Compute, Snap CVE-2020-36367.8u'Out of bound writes happen when accessing usage_table header entry beyond the memory allocated for the header' in Snapdragon Auto, Snapdra CVE-2020-363639.8Amazon AWS CloudFront TLSv1.2_2019 allows TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, which some entiti CVE-2020-363649.1An issue was discovered in Smartstore (aka SmartStoreNET) before 4.1.0. Administration/Controllers/ImportController.cs allows path traversal CVE-2020-363656.1Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskCont CVE-2020-363665.5Stack overflow vulnerability in parse_value Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted fil CVE-2020-363675.5Stack overflow vulnerability in parse_block Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted fil CVE-2020-363685.5Stack overflow vulnerability in parse_statement Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted