At my university, we have just gotten a panicy email about a libwebp
wide ranging vulnerability, Unfortunatly although long on dire warnings,
it was short on facts. It seemed to say that that there could be many
programs (in addition to Chrome) vulnerable (including all browsers, not just chrome)
, and seemed to imply that many
programs had compiled libwebp into the program.
Mageian has a /lib64/libwebp libraries which date back to Sept 26 2023,
and there seems to be an alert dated Oct 3
(https://lwn.net/Articles/946306/) which seems to impy that Mageia had
fixed this bug. But the week difference between libwebp files and the
advisory makes me wonder if it has been fixed in Mageia already.

Any insight and advice would be helpful.

On 2023-10-16 16:28, William Unruh wrote:
> At my university, we have just gotten a panicy email about a libwebp
> wide ranging vulnerability, Unfortunatly although long on dire warnings,
> it was short on facts. It seemed to say that that there could be many
> programs (in addition to Chrome) vulnerable (including all browsers, not just chrome)
> , and seemed to imply that many
> programs had compiled libwebp into the program.
> Mageian has a /lib64/libwebp libraries which date back to Sept 26 2023,
> and there seems to be an alert dated Oct 3
> (https://lwn.net/Articles/946306/) which seems to impy that Mageia had
> fixed this bug. But the week difference between libwebp files and the
> advisory makes me wonder if it has been fixed in Mageia already.
>
> Any insight and advice would be helpful.

https://www.cpomagazine.com/cyber-security/documented-libwebp-security-vulnerability-looks-to-be-part-of-pegasus-blastpass-attack-chain/
identifies the vulnerability as CVE-2023-4863.

Searching Mageia's Bugzilla,
https://bugs.mageia.org/show_bug.cgi?id=32280 shows that this was fixed
in both Mageia 8 and Mageia 9, and the update was pushed on October 3.

TJ

On 2023-10-16, TJ <TJ@noneofyour.business> wrote:
> On 2023-10-16 16:28, William Unruh wrote:
>> At my university, we have just gotten a panicy email about a libwebp
>> wide ranging vulnerability, Unfortunatly although long on dire warnings,
>> it was short on facts. It seemed to say that that there could be many
>> programs (in addition to Chrome) vulnerable (including all browsers, not just chrome)
>> , and seemed to imply that many
>> programs had compiled libwebp into the program.
>> Mageian has a /lib64/libwebp libraries which date back to Sept 26 2023,
>> and there seems to be an alert dated Oct 3
>> (https://lwn.net/Articles/946306/) which seems to impy that Mageia had
>> fixed this bug. But the week difference between libwebp files and the
>> advisory makes me wonder if it has been fixed in Mageia already.
>>
>> Any insight and advice would be helpful.
>
> https://www.cpomagazine.com/cyber-security/documented-libwebp-security-vulnerability-looks-to-be-part-of-pegasus-blastpass-attack-chain/
> identifies the vulnerability as CVE-2023-4863.
>
> Searching Mageia's Bugzilla,
> https://bugs.mageia.org/show_bug.cgi?id=32280 shows that this was fixed
> in both Mageia 8 and Mageia 9, and the update was pushed on October 3.

But the latest lipwebp packages have a date of Sep 26, not Oct 3. I
guess this could mean that they were compiled on Sep 26 but then,
brcause of testing, the package was only put out (without recompilation)
on Oct 3.

>
> TJ

On 2023-10-16, David W. Hodgins <dwhodgins@nomail.afraid.org> wrote:
> On Mon, 16 Oct 2023 16:28:49 -0400, William Unruh <unruh@invalid.ca> wrote:
>
>> At my university, we have just gotten a panicy email about a libwebp
>> wide ranging vulnerability, Unfortunatly although long on dire warnings,
>> it was short on facts. It seemed to say that that there could be many
>> programs (in addition to Chrome) vulnerable (including all browsers, not just chrome)
>> , and seemed to imply that many
>> programs had compiled libwebp into the program.
>> Mageian has a /lib64/libwebp libraries which date back to Sept 26 2023,
>> and there seems to be an alert dated Oct 3
>> (https://lwn.net/Articles/946306/) which seems to impy that Mageia had
>> fixed this bug. But the week difference between libwebp files and the
>> advisory makes me wonder if it has been fixed in Mageia already.
>>
>> Any insight and advice would be helpful.
>
> Mageia does not bundle libwebp in the various browsers or other packages, so it
> only has the one package for the system that had to be fixed, instead of having
> to fix every program that processes content from the web.
>
> Mageia makes proper usage of libification. Flatpak and other things like rust's
> cargo system that bundle a copy of a working version of every library used by
> a program require much more work for security updates. Instead of updating one
> package, dozens of packages have to be updated. Such systems are a security
> nightmare. There are exceptions where some libraries are bundled, but only a
> few, and libwebp is not used by any of those.
>
> While proper usage of libification is much better from a security point of view,
> it's also the main reason that Mageia uses a stable release model instead of a
> rolling release model. With a rolling release, the problem is similar to using
> bundled libraries. Much more work involved in every library package update.
>
> Regards, Dave Hodgins

I note that there is also a 32 bit version for libwebp, which is dated
Sep 6, not Sept 26. Does it also contain the latest fix for this
security flaw?