webp-converter@2.3.2 vulnerabilities

A small node.js library for converting any image to webp file format or converting webp image to any image file format.

latest version

2.3.3

first published

9 years ago

latest version published

3 years ago

licenses detected

MIT
>=0

View webp-converter package health on Snyk Advisor (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the webp-converter package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
C Heap-based Buffer Overflow Affected versions of this package are vulnerable to Heap-based Buffer Overflow when the `ReadHuffmanCodes()` function is used. An attacker can craft a special `WebP` lossless file that triggers the `ReadHuffmanCodes()` function to allocate the HuffmanCode buffer with a size that comes from an array of precomputed sizes: `kTableSize`. The `color_cache_bits` value defines which size to use. The `kTableSize` array only takes into account sizes for 8-bit first-level table lookups but not second-level table lookups. libwebp allows codes that are up to 15-bit (`MAX_ALLOWED_CODE_LENGTH`). When BuildHuffmanTable() attempts to fill the second-level tables it may write data out-of-bounds. The OOB write to the undersized array happens in ReplicateValue. Notes: This is only exploitable if the `color_cache_bits` value defines which size to use. This vulnerability was also published on libwebp CVE-2023-5129 Changelog: 2023-09-12: Initial advisory publication 2023-09-27: Advisory details updated, including CVSS, references 2023-09-27: CVE-2023-5129 rejected as a duplicate of CVE-2023-4863 2023-09-28: Research and addition of additional affected libraries 2024-01-28: Additional fix information How to fix Heap-based Buffer Overflow? There is no fixed version for `webp-converter`.	*

Heap-based Buffer Overflow

Affected versions of this package are vulnerable to Heap-based Buffer Overflow when the ReadHuffmanCodes() function is used. An attacker can craft a special WebP lossless file that triggers the ReadHuffmanCodes() function to allocate the HuffmanCode buffer with a size that comes from an array of precomputed sizes: kTableSize. The color_cache_bits value defines which size to use. The kTableSize array only takes into account sizes for 8-bit first-level table lookups but not second-level table lookups. libwebp allows codes that are up to 15-bit (MAX_ALLOWED_CODE_LENGTH). When BuildHuffmanTable() attempts to fill the second-level tables it may write data out-of-bounds. The OOB write to the undersized array happens in ReplicateValue.

Notes:

This is only exploitable if the color_cache_bits value defines which size to use.

This vulnerability was also published on libwebp CVE-2023-5129

Changelog:

2023-09-12: Initial advisory publication

2023-09-27: Advisory details updated, including CVSS, references

2023-09-27: CVE-2023-5129 rejected as a duplicate of CVE-2023-4863

2023-09-28: Research and addition of additional affected libraries

2024-01-28: Additional fix information

How to fix Heap-based Buffer Overflow?

There is no fixed version for webp-converter.

Go back to all versions of this package