Bug#1051787: Subject: CVE-2023-4863: Heap buffer overflow in WebP

2023-09-12 Thread Andres Salomon
reassign 1051787 libwebp thanks Actually I'm mistaken, we're building against the system libwebp so there's no need to update chromium at all for this CVE. The webp fix is the only (linux) change that chromium made between .180 and .187. On Tue, Sep 12 2023 at 11:34:26 AM -04:00:00,

Bug#1051787: Subject: CVE-2023-4863: Heap buffer overflow in WebP

2023-09-12 Thread Andres Salomon
clone 1051787 -1 reassign -1 libwebp thanks This bug's actually in libwebp. Unfortunately we're still embedding it in chromium, so we likely need to fix both chromium *and* libwebp in debian. There hasn't been a libwebp release yet, but the two relevant git commits are

Bug#1051787: Subject: CVE-2023-4863: Heap buffer overflow in WebP

2023-09-12 Thread Jeffrey Cliff
Package: chromium Version: 116.0.5845.180-1 Severity: grave Tags: security Justification: user security hole X-Debbugs-Cc: Debian Security Team Dear Maintainer, 116.0.5845.187 fixes a critical remote vulnerability in chrome [$NA][1479274] Critical CVE-2023-4863: Heap buffer overflow in WebP.