title: Use after free in libwebp
description: There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.
problem types: CWE-416 Use After Free
affected:
{
collectionURL: https://chromium.googlesource.com/webm/libwebp
defaultStatus: unaffected
packageName: libwebp
product: libwebp
repo: https://chromium.googlesource.com/
vendor: Chromium
versions:
lessThan: 1.3.1, status: affected, version: 0.4.2, versionType: custom
lessThan: 1.3.0-8-ga486d800, status: affected, version: 0.4.2, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL