GCVE - cpe:2.3:a:webmproject:libwebm:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:webmproject:libwebm:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Webmproject (`041199dd-212a-5381-8ad3-ce9542ea3f81`)
Product	Libwebm (`458343cb-625c-51fb-9781-c23abc7596bd`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/libwebp`	purl2cpe	2026-06-01 10:11:16.818789
`pkg:deb/ubuntu/libwebp`	purl2cpe	2026-06-01 10:11:16.818793
`pkg:github/webmproject/libwebm`	purl2cpe	2026-06-01 10:11:16.818796
`pkg:googlesource/webp`	purl2cpe	2026-06-01 10:11:16.818798
`pkg:nuget/vii.libwebp`	purl2cpe	2026-06-01 10:11:16.818801
`pkg:rpm/centos/libwebp`	purl2cpe	2026-06-01 10:11:16.818804
`pkg:rpm/fedora/libwebp`	purl2cpe	2026-06-01 10:11:16.818807
`pkg:rpm/opensuse/libwebp`	purl2cpe	2026-06-01 10:11:16.818809

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-9746`	vulnerable	2026-06-08 05:14:26.186188	Details available In libwebm before 2019-03-08, a NULL pointer dereference caused by the functions OutputCluster and OutputTracks in webm_info.cc will trigger an abort, which allows a DoS attack, a similar issue to CVE-2018-19212. Published: 2019-03-13T16:00:00.000Z Updated: 2024-09-16T19:41:28.756Z Open on db.gcve.eu Reference links https://bugs.chromium.org/p/webm/issues/detail?id=1605 https://chromium.googlesource.com/webm/libwebm/+/2427abe0bde234987ed005a3adca461e9a85dfb7	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-6548`	vulnerable	2026-06-08 05:11:53.946375	Details available A use-after-free issue was discovered in libwebm through 2018-02-02. If a Vp9HeaderParser was initialized once before, its property frame_ would not be changed because of code in vp9parser::Vp9HeaderParser::SetFrame. Its frame_ could be freed while the corresponding pointer would not be updated, leading to a dangling pointer. This is related to the function OutputCluster in webm_info.cc. Published: 2018-02-02T09:00:00.000Z Updated: 2024-08-05T06:10:10.324Z Open on db.gcve.eu Reference links https://github.com/dwfault/PoCs/blob/master/libwebm%20Vp9HeaderParser%20UAF%20by%20PrintVP9Info/libwebm%20Vp9HeaderParser%20UAF%20by%20PrintVP9Info.md https://bugs.chromium.org/p/webm/issues/detail?id=1493	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-6406`	vulnerable	2026-06-08 05:11:53.703078	Details available The function ParseVP9SuperFrameIndex in common/libwebm_util.cc in libwebm through 2018-01-30 does not validate the child_frame_length data obtained from a .webm file, which allows remote attackers to cause an information leak or a denial of service (heap-based buffer over-read and later out-of-bounds write), or possibly have unspecified other impact. Published: 2018-01-30T21:00:00.000Z Updated: 2024-09-17T03:33:34.070Z Open on db.gcve.eu Reference links https://bugs.chromium.org/p/webm/issues/detail?id=1492 https://github.com/dwfault/PoCs/blob/master/libwebm%20ParseVP9SuperFrameIndex%20memory%20corruption/libwebm%20ParseVP9SuperFrameIndex%20OOB%20read.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-19212`	vulnerable	2026-06-08 05:11:15.474933	Details available In libwebm through 2018-10-03, there is an abort caused by libwebm::Webm2Pes::InitWebmParser() that will lead to a DoS attack. Published: 2018-11-12T19:00:00.000Z Updated: 2024-09-16T21:03:30.309Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=1644196	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.