CVE-2023-1999

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416CWE-415

Affected software

VendorProductVersions
Chromiumlibwebp>= 0.4.2, < 1.3.1; >= 0.4.2, < 1.3.0-8-ga486d800

References

Timeline

Published
Jun 20, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-20005.4Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary websiteCVE-2023-200024.4A vulnerability in Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to bypass access controls and condCVE-2023-200038.8A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points (APs) could allow an uCVE-2023-200044.4Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary filCVE-2023-200056.1Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthentiCVE-2023-200067.5A vulnerability in the hardware-based SSL/TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco FirepCVE-2023-200077.2A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers CVE-2023-200087.1A vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to overwrite arbitrary CVE-2023-200097.2A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) coCVE-2023-20014.3An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all verCVE-2023-200108.8A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications CVE-2023-200118.8A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network C