https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/ A quick scan based on _.so_ files in the APK with _webp_ in the same gives: - [x] https://f-droid.org/packages/cc.narumi.chaldea.fdroid - dart? - [x] https://f-droid.org/packages/chat.fluffy.fluffychat - dart? - [x] https://f-droid.org/packages/com.abhinavmarwaha.wrotto - dart? - [x] https://f-droid.org/packages/com.adilhanney.saber - dart? - [x] https://f-droid.org/packages/com.alovoa.expo - Use fresco via expo-image-loader in 1.4.1 and older versions. - [ ] https://f-droid.org/packages/com.amaze.fileutilities - Use libwebp via opencv, https://github.com/TeamAmaze/AmazeFileUtilities/issues/130 - [x] https://f-droid.org/packages/com.calcitem.sanmill - dart? - [x] https://f-droid.org/packages/com.carriez.flutter_hbb - dart? - [x] https://f-droid.org/packages/com.czy0729.bangumi - Use libwebp via fresco, not affected - [x] https://f-droid.org/packages/com.ensoft.imgurviewer - Use [fresco](https://github.com/facebook/fresco) which only use libwepb on Android 4.2 and lower versions - [x] https://f-droid.org/packages/com.foobnix.pro.pdf.reader - [fixed in 8.9.46](https://gitlab.com/fdroid/fdroiddata/-/blob/50698161de927930a1a91cf318abb21b3210ab03/metadata/com.foobnix.pro.pdf.reader.yml#L726), [added af](https://gitlab.com/fdroid/fdroiddata/-/merge_requests/13783) - [x] https://f-droid.org/packages/com.formfun - Only take photos. Won't be affected. - [x] https://f-droid.org/packages/com.fr.laboussole.track - Use libwebp via fresco, so not affected - [x] https://f-droid.org/packages/com.github.andremiras.qrscan - Only take photos. Won't be affected. - [x] https://f-droid.org/packages/com.github.andremiras.zbarcamdemo - Only take photos. Won't be affected. - [x] https://f-droid.org/packages/com.github.andreyasadchy.xtra - https://gitlab.com/fdroid/fdroiddata/-/commit/4ac0780a4a34e2f9fbca0fdcafe6c51bc174a3e5 - [x] https://f-droid.org/packages/com.github.linwoodcloud.dev_doctor - dart? - [x] https://f-droid.org/packages/com.gitlab.uak.mobile_paper_wallet - No permission. Not affected. - [x] https://f-droid.org/packages/com.glitterware.passy - dart? - [x] https://f-droid.org/packages/com.hanntech.free2pass - dart? - [x] https://f-droid.org/packages/com.infomaniak.meet - Use libwebp via fresco via jitsi-meet-sdk, so not affected - [ ] https://f-droid.org/packages/com.lun.chin.aicamera - Use libwebp via opencv, no upstream reaction - [x] https://f-droid.org/packages/com.pavelsof.wormhole - Doesn't read pictures. Not affected. - [x] https://f-droid.org/packages/com.perflyst.twire - [upstream issue](https://github.com/twireapp/Twire/issues/433), fixed update is live - [x] https://f-droid.org/packages/com.samarthdesai.repeatme Dart? - [x] https://f-droid.org/packages/com.simondalvai.ball2box - [fixed in 4.0.0 already](https://github.com/dulvui/ball2box/releases/tag/v4.0.0), [added af for older](https://gitlab.com/fdroid/fdroiddata/-/commit/4280f63cf9db62acee63f229affff4af4b0cec8e), [will rebuild](https://gitlab.com/fdroid/fdroiddata/-/issues/3086#note_1580958313), [removed afs](https://gitlab.com/fdroid/fdroiddata/-/merge_requests/13848) - [x] https://f-droid.org/packages/com.simondalvai.pocketbroomball - [fixed in 5.0.4 already](https://github.com/dulvui/pocket-broomball/releases/tag/v5.0.4), [added af for older](https://gitlab.com/fdroid/fdroiddata/-/commit/95bd93ef60e31da7db4fce7231541adf8cc3db5b), [will rebuild](https://gitlab.com/fdroid/fdroiddata/-/issues/3086#note_1580958313), [removed afs](https://gitlab.com/fdroid/fdroiddata/-/merge_requests/13848) - [x] https://f-droid.org/packages/com.simplemobiletools.gallery.pro - dep GlideWebpDecoder ([lib was patched](https://github.com/zjupure/GlideWebpDecoder/releases/tag/2.6)), [upstream issue](https://github.com/SimpleMobileTools/Simple-Gallery/issues/2990#issuecomment-1742878772), also [dep APNG4Android for animated webp upstream issue](https://github.com/penfeizhou/APNG4Android/issues/207) , [updated](https://gitlab.com/fdroid/fdroiddata/-/commit/0f014d43ecce5bad67b3c993c36bf80f2bb698b8), [added af](https://gitlab.com/fdroid/fdroiddata/-/commit/6bb11ec4c6b1d06a91b49ad61594e4581485fda5) - [x] https://f-droid.org/packages/com.stonegate.tsacdop - dart? - [x] https://f-droid.org/packages/com.zfdang.zsmth_android - Use [fresco](https://github.com/facebook/fresco) which only use libwepb on Android 4.2 and lower versions - [x] https://f-droid.org/packages/csd.qtproject.minesweeper - Doesn't read external images. Not affected. - [x] https://f-droid.org/packages/de.akaflieg_freiburg.enroute - Already disabled. - [x] https://f-droid.org/packages/deckers.thibault.aves.libre - dart? - [x] https://f-droid.org/packages/de.jbservices.nc_passwords_app - dart? - [x] https://f-droid.org/packages/de.spiritcroc.riotx - [Fixed in sc_v1.6.5.sc72](https://gitlab.com/fdroid/fdroiddata/-/commit/563e95606d80bf2a430e84d364cc6d2881100803), [upstream issue](https://github.com/SchildiChat/SchildiChat-android/issues/210), [added af](https://gitlab.com/fdroid/fdroiddata/-/merge_requests/13782) - [x] https://f-droid.org/packages/dev.linwood.butterfly - dart? - [x] https://f-droid.org/packages/dev.linwood.butterfly.nightly - dart? - [x] https://f-droid.org/packages/de.wger.flutter - dart? - [x] https://f-droid.org/packages/es.ideotec.wdnotes - dart? - [x] https://f-droid.org/packages/eu.bauerj.paperless_app - dart? - [x] https://f-droid.org/packages/eu.hydrologis.smash - dart? - [x] https://f-droid.org/packages/eu.kanade.tachiyomi - Libwebp [updated](https://github.com/tachiyomiorg/tachiyomi/commit/66a938779df1e1400125b987c23c29ac411dda6d), no release yet. - [x] https://f-droid.org/packages/ie.equalit.ceno - pinged upstream https://gitlab.com/censorship-no/ceno-browser/-/issues/105, fixed in https://gitlab.com/fdroid/fdroiddata/-/commit/6c59f6077707762486fe7c1cc778b1db1b662b51 - [x] https://f-droid.org/packages/in.p1x.tanks_of_freedom - Godot 2, no longer actively developed, no permission, not affected - [x] https://f-droid.org/packages/io.davidar.tensor - dart? - [x] https://f-droid.org/packages/io.ente.photos.fdroid - dart? - [x] https://f-droid.org/packages/io.github.alketii.mightyknight - Godot 2, no permission, not affected - [x] https://f-droid.org/packages/io.githubfede0d.planetrider - Godot 2, no permission, not affected - [x] https://f-droid.org/packages/io.github.freewatermark.mobileapp - dart? - [x] https://f-droid.org/packages/io.github.kobuge.games.minilens - Godot 2, no permission, not affected - [x] https://f-droid.org/packages/io.librehealth.toolkit.cost_of_care - dart? - [x] https://f-droid.org/packages/ir.hsn6.defendo - Godot 2, no permission, not affected - [x] https://f-droid.org/packages/ir.hsn6.k2 - Godot 2, no permission, not affected - [x] https://f-droid.org/packages/ir.hsn6.tpb - Godot 3.2.3, no permission, not affected - [x] https://f-droid.org/packages/ir.hsn6.trans - Godot 2, no permission, not affected - [x] https://f-droid.org/packages/ir.hsn6.turo - Godot 2, no permission, not affected - [x] https://f-droid.org/packages/me.austinhuang.instagrabber - Use libwebp via fresco, so not affected - [x] https://f-droid.org/packages/me.kavishhukmani.watwitchstickers - Use libwebp via fresco, so not affected - [x] https://f-droid.org/packages/nekox.messenger - Fixed in https://gitlab.com/fdroid/fdroiddata/-/commit/3c0608437c402e2ec322dd92c4f8bfe7daf7e0cf - [x] https://f-droid.org/packages/net.gcompris.full Only read trusted images - [x] https://f-droid.org/packages/nl.moeilijkedingen.jellyfinaudioplayer - Use libwebp via react-native-skia, [reported](https://github.com/leinelissen/jellyfin-audio-player/issues/182) - [x] https://f-droid.org/packages/org.cimbar.camerafilecopy - Only takes photos, not affected - [x] https://f-droid.org/packages/org.dash.electrum.electrum_dash - Use libwebp via pillow but only read images from camera so not affected. - [x] https://f-droid.org/packages/org.develz.crawl - No permission, not affected - [x] https://f-droid.org/packages/org.documentfoundation.libreoffice - https://gitlab.com/fdroid/fdroiddata/-/merge_requests/13777 - [x] https://f-droid.org/packages/org.forkgram.messenger - [Fixed](https://github.com/forkgram/TelegramAndroid/commit/2a5283899ea4f530e5761d388eab6544b3adab49) in 9.9.2.0. - [x] https://f-droid.org/packages/org.godotengine.editor.v3 - [3.5.3 was released with updated webp](https://godotengine.org/article/maintenance-release-godot-3-5-3/), [added version](https://gitlab.com/fdroid/fdroiddata/-/commit/ddc41634012da81c0b9e58ab8a8a1ad62887ed11), [added AF for older](https://gitlab.com/fdroid/fdroiddata/-/commit/f34833ef7a99100240bebbd0fb09ad7bf665dcc8) - [x] https://f-droid.org/packages/org.godotengine.editor.v4 - [updated and added af](https://gitlab.com/fdroid/fdroiddata/-/commit/2e43a4a20515f765c2ab21cf9d2b744be0c48cdd) - [ ] https://f-droid.org/packages/org.jschwab.openrecipes - [upstream issue](https://gitlab.com/ddorian/openrecipes/-/issues/25), no upstream reaction - [x] https://f-droid.org/packages/org.koreader.launcher.fdroid - Libwebp [updated](https://github.com/koreader/koreader-base/tree/4733fa06a48beb30d5e70b31358e9e537d87eca4) in 2023.10 - [ ] https://f-droid.org/packages/org.krita - Libwebp [updated](https://invent.kde.org/graphics/krita/-/commit/d8d6ab4cb7b5d73bc9e53f973c162bd3a5750a7b), can't build the new version yet. - [x] https://f-droid.org/packages/org.lufebe16.lbalance - Use libwebp via kivy, no permission, not affected - [x] https://f-droid.org/packages/org.lufebe16.pysolfc - Use libwebp via kivy, doesn't read images, not affected - [x] https://f-droid.org/packages/org.mozilla.fennec_fdroid - fixed in 117.1.0, [added af](https://gitlab.com/fdroid/fdroiddata/-/merge_requests/13776) - [x] https://f-droid.org/packages/org.pipoypipagames.cowsrevenge - Godot 2, no permission, not affected - [x] https://f-droid.org/packages/org.pipoypipagames.towerjumper - Godot 2, no permission, not affected - [x] https://f-droid.org/packages/org.retroshare.android.qml_app - Use libwebp via qt. Not maintained so archive directly. https://gitlab.com/fdroid/fdroiddata/-/merge_requests/13841 - [x] https://f-droid.org/packages/org.revengate.revengate - Godot v4 engine [pinged upstream](https://gitlab.com/ygingras/revengate/-/issues/8), no permission, not affected - [x] https://f-droid.org/packages/org.sajeg.fallingblocks - Godot v3, [updated, added af](https://gitlab.com/fdroid/fdroiddata/-/commit/b22dad8f0b624fadb3fe46e46e1ec4a1589d9644) - [x] https://f-droid.org/packages/org.telegram.messenger - Fixed in https://gitlab.com/fdroid/fdroiddata/-/commit/3c0608437c402e2ec322dd92c4f8bfe7daf7e0cf, [upstream issue](https://github.com/Telegram-FOSS-Team/Telegram-FOSS/issues/700) - [x] https://f-droid.org/packages/org.tuxpaint - No permission, not affected - [x] https://f-droid.org/packages/priv.wh201906.serialtest Doesn't read images, not affected - [x] https://f-droid.org/packages/pro.oblivioncoding.fluffy_board - dart? - [x] https://f-droid.org/packages/rocks.mucke - dart? - [x] https://f-droid.org/packages/software.mdev.bookstracker - dart? - [x] https://f-droid.org/packages/us.spotco.fennec_dos - fixed in 117.1.0, [added af](https://gitlab.com/fdroid/fdroiddata/-/merge_requests/13776) Here's my quick check script: ```bash for f in *.apk; do (unzip -l $f | grep -Eoi '\S+/\S*webp\S*\.so') && echo "^^ has webp: $f" done ``` Possible actions: * Ping upstream to update * Add patch to metadata to patch _libwebp_ * Archive affected APKs * Tag with `KnownVuln`