CVE-2023-4863: track down apps with the WebP vuln and respond

https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/

A quick scan based on .so files in the APK with webp in the same gives:

Here's my quick check script:

for f in *.apk; do
  (unzip -l $f | grep -Eoi '\S+/\S*webp\S*\.so') && echo "^^ has webp: $f"
done

Possible actions:

  • Ping upstream to update
  • Add patch to metadata to patch libwebp
  • Archive affected APKs
  • Tag with KnownVuln
Edited by Licaon_Kter