One image library, hundreds of apps to update
The WebP bug was fixed in Chrome in days. The same code sits inside Slack, Teams and many other apps.
Two weeks ago Chrome shipped an emergency fix for CVE-2023-4863, a bug in libwebp, the library that decodes WebP images. A malicious image could run code, and it was already being exploited.
Updating Chrome and Firefox was the easy part. libwebp is also inside many other apps: anything built on Electron (Slack, Teams, Discord, VS Code and plenty more), some Linux packages, mobile apps and container images. Each one needs its own update.
What to do:
- Browsers: make sure they restarted after updating. A pending update protects nobody.
- Desktop apps: update chat, meeting and editor apps, and check their release notes for the WebP fix.
- Servers: update the libwebp package on Linux, and rebuild container images that include it.
- Your own software: check whether you bundle libwebp or an image library that does.
This is what a shared library bug looks like: one fix upstream, then weeks of chasing every place it was copied. A software inventory makes that chase much shorter.