#libwebp — Public Fediverse posts

So I needed a WebP encoder for a Go project where I had #CGO disabled. I found there is an option using #libwebp compiled to #wasm running on #wazero, but that's pretty slow and uses lots of memory.

So I made a pure #GoLang encoder, ported from a Rust encoder then optimized: https://github.com/SeriousBug/webp-go-pure#webp-go-pure

I managed to get better performance than the WASM version! Both encoding speed and memory use, although compression rate and quality is a bit worse.

#webdev #webp

Fedi, help:
I am trying to use cwebp to convert images to webp. I have previously done this successfully in an arch distrobox. Now, though, it doesn't work.

distrobox enter arch
bash: warning: setlocale: LC_CTYPE: cannot change locale (en_US.UTF-8): No such file or directory
bash: warning: setlocale: LC_CTYPE: cannot change locale (en_US.UTF-8): No such file or directory
bash: warning: setlocale: LC_COLLATE: cannot change locale (en_US.UTF-8): No such file or directory
bash: warning: setlocale: LC_CTYPE: cannot change locale (en_US.UTF-8): No such file or directory
bash: warning: setlocale: LC_CTYPE: cannot change locale (en_US.UTF-8): No such file or directory
bash: warning: setlocale: LC_COLLATE: cannot change locale (en_US.UTF-8): No such file or directory
cwebp -lossless -q 100 example.png -o example.webp
bash: cwebp: command not found

sudo pacman -S libwebp

Kolejny dzień, kolejna paczka #RustLang, która nie ufa dzielonym bibliotekom i zamiast tego używa swojej przypadkowej wersji #libwebp. A potem nagle trafia się CVE i z łaski swojej rozważa dopuszczenie możliwości statycznego wiązania z systemową biblioteką — tyle że było to półtora roku temu, i nic od tego czasu się nie ruszyło. A ja teraz się użeram z łataniem tego szajsu, bo coś się sypie użytkownikom #Gentoo, i jedyne co mi przychodzi do głowy to to, że włączona wersja libwebp kłóci się z systemową, której używa gtk4.

Sigh. Another day, another #RustLang packages that doesn't trust shared libraries and instead bundles random version of #libwebp. Then hits a CVE and starts considering graciously permitting people to maybe statically link to the system library — except that was 1.5 year ago and nothing happened since. And now I'm patching that crap because shit is falling apart for #Gentoo users, and my best guess is that vendored libwebp is conflicting somehow with shared libwebp that gtk4 links to.

So, #HurricaneMilton is on the way and how do I kill my time waiting for this sucker? I recompile #FFMPEG 7.1 for all the options I've always wanted to use...but never get to compile correctly. Like #libwebp, #vidstab, and #libbluray!

Geez! I feel like @lisamelton right now! 😂❤️ I feel like this is what she does when she's stressed!

It was either this or rewatch all the Marvel movies... 😳

#Milton

It's been a few months since last year's #libwebp 0day (#CVE_2023_4863) came out, and I'm curious about whether the alarm has ratcheted down. It kinda seemed like this was potentially a pretty bad vuln if you're a political dissident using Electron apps to organize against oppressive governments, but probably not a super dangerous situation for most corporate networks (with basically no chance of broad automated exploitation). But as I think @TomSellers pointed out early on, the tail of apps that use the vulnerable library was always going to be long, and that usually means it's hard to track just how many are/were exploitable out of the box, and that it could be years before high-impact (remote) attack vectors are identified and fixed.

This is a fantastic overview: https://blog.isosceles.com/the-webp-0day/

"Patching the libwebp vulnerability across the Python ecosystem"

https://sethmlarson.dev/security-developer-in-residence-weekly-report-16?date=2023-10-25

#security #supplychain #python #libwebp

Looking for some help, my company might not be able to fully patch CVE-2023-4863 aka BLASTPASS for a few days. Does anyone know a way of detecting exploitation of this through Splunk? Can you see it in web server logs? Next-gen firewall? WAF? I’m not seeing much info online about how to detect the exploitation.

#libwebp #cve20234863 #blastpass #splunk #siem

Woohoo, another day, another #0day like the #libwebp one, this time in #libvpx: https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/

Let the purge / patch crunch begin!

I see that with the whole #libwebp mess, this 14 years old blog post is still totally relevant: https://flameeyes.blog/2009/01/02/bundling-libraries-for-despair-and-insecurity/

#bundling #libraries #despair #insecurity

The #libwebp security vulnerability might affect #ComputationalScientist:s, especially those that make their own #conda environments and process image data (via code or apps). Our blog post discusses what a #SciComp person might need to know (and if you have corrections or more suggestions, please send them our way)
https://aaltoscicomp.github.io/blog/2023/webp-security-vulnerability/

#webp #RSEng #HPC #security

So um does this #libwebp #vulnerability affect #Mastodon ? Didn't see any mention of it in the Github Issues...

#security #mastoAdmin

#CyberVeille #libwebp #libvpx

🗒️ petit résumé / annotations surs les deux vulnérabilités basés sur les denières information disponibles au 29.09

"CVE-2023-5217 [ ndr 𝐥𝐢𝐛𝐯𝐩𝐱 ] requires a targeted device to create media in the VP8 format.

CVE-2023-4863 [ndr 𝐖𝐞𝐛𝐏 / 𝐥𝐢𝐛𝐰𝐞𝐛𝐏 ] could be exploited when a targeted device simply displayed a booby-trapped image."
👇
https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/

CVE-2023-5129 ➡️ Retirée par Mitre Duplicata CVE-2023-4863
👇
https://www.cve.org/CVERecord?id=CVE-2023-5129

------------------------

liste utile pour (merci @mttaggart ) suivi CVE-2023-4863 dans apps Electron
👇
https://docs.google.com/spreadsheets/d/1QLLFYCO0FMAu1ob6mnYCapW8dnx-HXunbf_zc9QLXlM/edit#gid=1774064991

FAQ CVE-2023-4863 par Tenable
👇
https://www.tenable.com/blog/cve-2023-41064-cve-2023-4863-cve-2023-5129-faq-imageio-webp-zero-days

------------------------

Annonce CVE-2023-5217
👇
https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html

Here's a non-exhaustive list of all the stuff I've seen people doing to mitigate #cve20234863 #libwebp

https://www.justinmcafee.com/2023/09/libwebp-cve-2023-4683.html

New 0-day in Chrome and Firefox will likely plague other software - Enlarge (credit: Getty Images)

A critical zero-day vulnerabili... - https://arstechnica.com/?p=1972043 #security #zero-day #exploit #firefox #libwebp #biz⁢ #chrome #libvpx

Maybe relying on one company's browser product for your entire computer is not a good idea.

#libWebP #libVPX #Electron

Yeah, this isn't scary at all. Sure some may not be confirmed vulnerable but.. damn...

https://infosec.town/notes/9k5swp89shc4t888

#cybersecurity #infosec #libwebp #infosec

Unzählige Anwendungen betroffen: WebP-Schwachstelle erreicht maximalen Schweregrad - Golem.de
https://glm.io/178002?n #Libwebp #WebP

*Sigh*, another one of these:

"CVE-2023-5217: Heap buffer overflow in vp8 encoding in #libvpx."
"Google is aware that an exploit for CVE-2023-5217 exists in the wild."

Note that because it's in an underlying (video codec) library, it's probably going to be an issue in every browser and video player and electron app; just like the prior #libwebp #security bug.

For those tracking CVE-2023-5129 CVE-2023-4863, aka the #Libwebp fiasco, here's how to validate if your Electron app is vulnerable.

The patched version of Electron is v26.2.1. To confirm what version of Electron your app is using, you need to run strings against the executable. The version is in the app's User-Agent, so:

strings app.exe | grep "Electron/"

#WebP: Critical security #vulnerability in the #libwebp image library for rendering images in the WebP format is under active exploitation in the wild. CVE-2023-5129(CVSS 10.00) allows criminals to hack your devices by simply sending you an image:🖼️

https://thehackernews.com/2023/09/new-libwebp-vulnerability-under-active.html?m=1

Google quietly corrects previously submitted disclosure for critical webp 0-day - Enlarge / Malware Detected Warning Screen with abstract binary code 3d ... - https://arstechnica.com/?p=1971345 #security #libwebp #biz⁢ #chrome #google #webp

#libwebp CVE-2023-5129 doesn't appear to be a new issue. The fix to it was committed Sep 7th 2023 and has already been released as part of libwebp 1.3.2.

Update: This just appears to be "correctly" assigned CVE-2023-4863. #infosec #vulnerability #cve