Skip to content
Fencer Vulns
no cvss —

CVE-2023-5129 json

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

published 2023-09-25 3 y ago modified 2023-11-07 3 y ago

Withdrawn or rejected on 2023-09-27

Its source no longer considers this a valid vulnerability. It stays here so links keep working, and it is left out of feeds.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate of CVE-2023-4863.

Patch / fix

  • libwebp RHEL 9 1.2.0-7.el9_2
  • libwebp-tools RHEL 9 1.2.0-7.el9_2
  • firefox RHEL 8 102.15.1-1.el8_8
  • thunderbird RHEL 8 102.15.1-1.el8_8
  • libwebp RHEL 8 1.0.0-8.el8_8.1
  • thunderbird RHEL 7 102.15.1-1.el7_9
  • firefox RHEL 9 102.15.1-1.el9_2
  • firefox-x11 RHEL 9 102.15.1-1.el9_2

red hat advisories RHSA-2023:5214RHSA-2023:5223RHSA-2023:5185RHSA-2023:5198RHSA-2023:5202RHSA-2023:5192

  • cargo-audit-advisory-db openSUSE Tumbleweed 20231007-1.1

opensuse advisories openSUSE-SU-2024:13304-1

  • libwebp Rocky Linux 9 1.2.0-7.el9_2
  • thunderbird Rocky Linux 8 102.15.1-1.el8_8

rocky linux advisories RLSA-2023:5214RLSA-2023:5201

  • tiledb Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 2.17.4-r0

alpine advisories ALPINE-CVE-2023-5129

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-5129 updated cvss 0.0

libwebp: out-of-bounds write with a specially crafted WebP lossless file

  • Red Hat Enterprise Linux 6 firefox
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 9 firefox, firefox-x11, thunderbird
    affected: no fix available
  • Red Hat Enterprise Linux AppStream (v. 8) libwebp 1.0.0-8.el8_8.1, firefox 102.15.1-1.el8_8, thunderbird 102.15.1-1.el8_8
    fixed: vendor fix RHSA-2023:5184
  • Red Hat Enterprise Linux AppStream (v. 9) libwebp 1.2.0-7.el9_2, firefox 102.15.1-1.el9_2, firefox-x11 102.15.1-1.el9_2, thunderbird 102.15.1-1.el9_2
    fixed: vendor fix RHSA-2023:5200
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) libwebp 1.0.0-7.el8_2.1, firefox 102.15.1-1.el8_2, thunderbird 102.15.1-1.el8_2
    fixed: vendor fix RHSA-2023:5187
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox 102.15.1-1.el8_4, thunderbird 102.15.1-1.el8_4
    fixed: vendor fix RHSA-2023:5192
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) firefox 102.15.1-1.el8_1, libwebp 1.0.0-5.2.el8_1.1, thunderbird 102.15.1-1.el8_1
    fixed: vendor fix RHSA-2023:5183
  • Red Hat Enterprise Linux AppStream E4S (v. 8.2) libwebp 1.0.0-7.el8_2.1, firefox 102.15.1-1.el8_2, thunderbird 102.15.1-1.el8_2
    fixed: vendor fix RHSA-2023:5187
show 9 more
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) firefox 102.15.1-1.el8_4, thunderbird 102.15.1-1.el8_4
    fixed: vendor fix RHSA-2023:5192
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) libwebp 1.0.0-7.el8_6.1, firefox 102.15.1-1.el8_6, thunderbird 102.15.1-1.el8_6
    fixed: vendor fix RHSA-2023:5198
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) libwebp 1.2.0-6.el9_0, firefox 102.15.1-1.el9_0, thunderbird 102.15.1-1.el9_0
    fixed: vendor fix RHSA-2023:5205
  • Red Hat Enterprise Linux AppStream TUS (v. 8.2) libwebp 1.0.0-7.el8_2.1, firefox 102.15.1-1.el8_2, thunderbird 102.15.1-1.el8_2
    fixed: vendor fix RHSA-2023:5187
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) firefox 102.15.1-1.el8_4, thunderbird 102.15.1-1.el8_4
    fixed: vendor fix RHSA-2023:5192
  • Red Hat Enterprise Linux Client (v. 7) firefox 102.15.1-1.el7_9, thunderbird 102.15.1-1.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) firefox 102.15.1-1.el7_9
    fixed: vendor fix RHSA-2023:5197
  • Red Hat Enterprise Linux CRB (v. 9) libwebp-tools 1.2.0-7.el9_2
    fixed: vendor fix RHSA-2023:5214
  • Red Hat Enterprise Linux Server (v. 7) firefox 102.15.1-1.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) firefox 102.15.1-1.el7_9, thunderbird 102.15.1-1.el7_9 Red Hat Enterprise Linux Workstation (v. 7) firefox 102.15.1-1.el7_9, thunderbird 102.15.1-1.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) firefox 102.15.1-1.el7_9
    fixed: vendor fix RHSA-2023:5197
  • Red Hat Enterprise Linux 7 libwebp, libwebp-java, libwebp-tools
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.