Test ID:	1.3.6.1.4.1.25623.1.1.2.2021.2594
Category:	Huawei EulerOS Local Security Checks
Title:	Huawei EulerOS: Security Advisory for libwebp (EulerOS-SA-2021-2594)
Summary:	The remote host is missing an update for the Huawei EulerOS 'libwebp' package(s) announced via the EulerOS-SA-2021-2594 advisory.
Description:	Summary: The remote host is missing an update for the Huawei EulerOS 'libwebp' package(s) announced via the EulerOS-SA-2021-2594 advisory. Vulnerability Insight: A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability is to data confidentiality and to the service availability.(CVE-2020-36331) A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function WebPMuxCreateInternal. The highest threat from this vulnerability is to data confidentiality and to the service availability.(CVE-2018-25009) A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow was found in PutLE16(). The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2018-25011) A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function WebPMuxCreateInternal. The highest threat from this vulnerability is to data confidentiality and to the service availability.(CVE-2018-25012) A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ShiftBytes. The highest threat from this vulnerability is to data confidentiality and to the service availability.(CVE-2018-25013) A flaw was found in libwebp in versions before 1.0.1. An uninitialized variable is used in function ReadSymbol. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2018-25014) A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-36328) flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-36329) Affected Software/OS: 'libwebp' package(s) on Huawei EulerOS V2.0SP3. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2018-25009 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9100 https://bugzilla.redhat.com/show_bug.cgi?id=1956917 https://chromium.googlesource.com/webm/libwebp/+/95fd65070662e01cc9170c4444f5c0859a710097 Common Vulnerability Exposure (CVE) ID: CVE-2018-25011 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9119 https://bugzilla.redhat.com/show_bug.cgi?id=1956919 https://chromium.googlesource.com/webm/libwebp/+/v1.0.1 https://chromium.googlesource.com/webm/libwebp/+log/be738c6d396fa5a272c1b209be4379a7532debfe..29fb8562c60b5a919a75d904ff7366af423f8ab9?pretty=fuller&n=10000 Common Vulnerability Exposure (CVE) ID: CVE-2018-25012 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9123 https://bugzilla.redhat.com/show_bug.cgi?id=1956922 Common Vulnerability Exposure (CVE) ID: CVE-2018-25013 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9417 https://bugzilla.redhat.com/show_bug.cgi?id=1956926 https://chromium.googlesource.com/webm/libwebp/+/907208f97ead639bd521cf355a2f203f462eade6 Common Vulnerability Exposure (CVE) ID: CVE-2018-25014 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9496 https://bugzilla.redhat.com/show_bug.cgi?id=1956927 https://chromium.googlesource.com/webm/libwebp/+log/78ad57a36ad69a9c22874b182d49d64125c380f2..907208f97ead639bd52 Common Vulnerability Exposure (CVE) ID: CVE-2020-36328 Debian Security Information: DSA-4930 (Google Search) https://www.debian.org/security/2021/dsa-4930 http://seclists.org/fulldisclosure/2021/Jul/54 https://bugzilla.redhat.com/show_bug.cgi?id=1956829 https://lists.debian.org/debian-lts-announce/2021/06/msg00005.html https://lists.debian.org/debian-lts-announce/2021/06/msg00006.html Common Vulnerability Exposure (CVE) ID: CVE-2020-36329 https://bugzilla.redhat.com/show_bug.cgi?id=1956843 Common Vulnerability Exposure (CVE) ID: CVE-2020-36331 https://bugzilla.redhat.com/show_bug.cgi?id=1956856
Copyright	Copyright (C) 2021 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.