I recently saw an article (https://stackdiary.com/heap-buffer-overflow-in-libwebp-cve-2023-5129/) that said WEBP images could be a huge security hole right now and I know Lemmy uses a lot of WEBP images.

I’m not sure how long this has been known, so maybe the Liftoff devs already took care of it. Does anyone know if Liftoff has already made the necessary patches?

  • Illecors@lemmy.cafe
    link
    fedilink
    English
    arrow-up
    19
    ·
    1 year ago

    The vulnerability is fixed within pict-rs, which is part of lemmy instance default setup. It’s such a coincidence that I’ve just updated it on mine.

    TL;DR - it is not up to liftoff to fix it.

    • MeatAndSarcasmGuy@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 year ago

      Oh that’s interesting. I thought it would be through the app, since the article mentioned being patched in browsers; so that’s definitely good to know.

    • henfredemars@infosec.pub
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      1 year ago

      I must disagree. The information is public and there are many sources that describe how to construct such a file that can trigger the heap buffer overflow. You don't need to understand all the theory to cause the overflow.

      I don't think it's that complicated. I'm sure it will be used as an N-day for a long time.

      The key to effective exploitation is learning to understand deeply only those parts that require deep understanding.