CVE-2023-1999 · cross-distro fix matrix

CVE-2023-1999: There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial

Affects 8 Linux releases across 19 (distro × package) combinations.

Fix per ecosystem

Each block below is a distro release where CVE-2023-1999 has a known fix. Run the listed command on that distro to remediate.

Source: Debian Security Tracker

firefox-esr→ fixed in102.10.0esr-1~deb11u1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y firefox-esr
```
libwebp→ fixed in0.6.1-2.1+deb11u1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y libwebp
```
thunderbird→ fixed in1:102.10.0-1~deb11u1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y thunderbird
```

Source: Debian Security Tracker

firefox-esr→ fixed in102.10.0esr-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y firefox-esr
```
libwebp→ fixed in1.2.4-0.2urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y libwebp
```
thunderbird→ fixed in1:102.10.0-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y thunderbird
```

Source: Debian Security Tracker

firefox-esr→ fixed in102.10.0esr-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y firefox-esr
```
libwebp→ fixed in1.2.4-0.2urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y libwebp
```
thunderbird→ fixed in1:102.10.0-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y thunderbird
```