Hi @BillyJBryant Thank you very much for your explanation. Much appreciated. So yes based on your info and from what I have read so far this one can also be considered as a zero-click.

What I did notice though is that #CVE20235129 has been retracted and is not valid. There is now only the original one which has a score of 8.8. Still high, but a little less than the 10.0 🙂

Good Morning, story so far on the next log4j level #vulnerability #CVE20234863 #CVE20235129
#0day #Chrome #iOS

• libwebp library is vulnerable to heap overflow and can lead to RCE.
• Apple assigned #CVE202341064 and #CVE202341061. Also actively exploited by #blastpass
• #Google assigned #CVE20235129 for Chrome 0day and also exploited
• Millions of apps and software use this library. See list sofar in 🧵
• #CVE20235129 was rejected by NVD earlier due to all this confusion of several vendors assigning CVEs affecting their products
• This will lead to vulnerability scanners not being able to correctly identify if your assets are affected with libwebp. #infosec #sectoot

🚨0-Day Critical CVSS 10.0 🚨

Chrome, Teams, and much more are affected in this new zero-day centered around LibWebP with a max CVSS score of 10.0

CVE-2023–5129 is turning out to be the next Log4j, a common library affecting untold numbers of applications and even baked into most Linux OSes.

In my most comprehensive blog post ever, I give a deep dive into the background. List ALL known affected software (so you can see if you're affected), and provide technical and organizational recommendations on how to address it.

DON'T MISS OUT:
https://medium.com/@penquestr/libwebp-the-new-log4j-3e932b35bdcb

Please Share to spread awareness!

#cyber #cybernews #cybersecurity #Chrome #googlechrome #0day #zeroday #alert #informationsecurity #infosec
#CVE20235129

@campuscodi This article claims that it is a new CVE for the same vulnerability, to clarify scope?

https://stackdiary.com/heap-buffer-overflow-in-libwebp-cve-2023-5129/

But this seclists thread seems to say that CVE-2023-5129 is associated with libwebp commits that are different from the fixes associated with CVE-2023-4863 [Edit: but these are described by the issuer as cleanups]:

https://seclists.org/oss-sec/2023/q3/230

The seclists poster is reaching out to double-check whether it's new. Solar Designer's assessment is that it's probably the same (but that the cleanups in the code should be examined anyway):

https://seclists.org/oss-sec/2023/q3/236

#CVE20235129 #CVE20234863 #CVE_2023_4863 ##CVE_2023_5129 #libwebp

Google assigns a CVE for libwebp and gives it a 10.0 score

https://stackdiary.com/heap-buffer-overflow-in-libwebp-cve-2023-5129/

#security #webp #libwebp #cve20235129 #cve20234863