CVE catalog

CVE-2018-25009

libwebp: CVE-2018-25009

[CVE catalog]

Severity
Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.10% · Oct 25, 2026

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16().

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibwebpsid1.6.0-0.1fixed
Debianlibwebpforky1.6.0-0.1fixed
Debianlibwebptrixie1.5.0-0.1fixed
Debianlibwebpbookworm1.2.4-0.2+deb12u1fixed
Debianlibwebpbookworm-security1.2.4-0.2+deb12u1fixed
Ubuntulibwebppro0.4.3-1.3vulnerable
Ubuntulibwebppro0.4.3-1.3build1vulnerable
Ubuntulibwebppro0.4.4-1vulnerable
Ubuntulibwebppro0.4.4-1ubuntu0.1~esm1fixed
Ubuntulibwebp18.040.6.0-3vulnerable
Ubuntulibwebp18.040.6.0-4vulnerable
Ubuntulibwebp18.040.6.1-1vulnerable
Ubuntulibwebp18.040.6.1-2vulnerable
Ubuntulibwebp18.040.6.1-2ubuntu0.18.04.1fixed
Ubuntulibwebp20.040.6.1-2vulnerable
Ubuntulibwebp20.040.6.1-2ubuntu0.20.04.1fixed
Ubuntulibwebppro0.4.3-1.3vulnerable
Ubuntulibwebppro0.4.3-1.3build1vulnerable
Ubuntulibwebppro0.4.4-1vulnerable
Ubuntulibwebppro0.4.4-1ubuntu0.1~esm1fixed
Ubuntulibwebp18.040.6.0-3vulnerable
Ubuntulibwebp18.040.6.0-4vulnerable
Ubuntulibwebp18.040.6.1-1vulnerable
Ubuntulibwebp18.040.6.1-2vulnerable
Ubuntulibwebp18.040.6.1-2ubuntu0.18.04.1fixed
Ubuntulibwebp20.040.6.1-2vulnerable
Ubuntulibwebp20.040.6.1-2ubuntu0.20.04.1fixed
Suselibwebphpe helion openstack 80.4.3-4.7.1fixed
Suselibwebpopenstack cloud 70.4.3-4.7.1fixed
Suselibwebpopenstack cloud 80.4.3-4.7.1fixed
Suselibwebpopenstack cloud 90.4.3-4.7.1fixed
Suselibwebpopenstack cloud crowbar 80.4.3-4.7.1fixed
Suselibwebpopenstack cloud crowbar 90.4.3-4.7.1fixed
Suselibwebplinux enterprise server for sap applications 12 sp30.4.3-4.7.1fixed
Suselibwebplinux enterprise server for sap applications 12 sp40.4.3-4.7.1fixed
Suselibwebplinux enterprise software development kit 12 sp50.4.3-4.7.1fixed
Suselibwebplinux enterprise server 12 sp2-bcl0.4.3-4.7.1fixed
Suselibwebplinux enterprise server 12 sp3-ltss0.4.3-4.7.1fixed
Suselibwebplinux enterprise server 12 sp3-bcl0.4.3-4.7.1fixed
Suselibwebplinux enterprise server 12 sp4-ltss0.4.3-4.7.1fixed
Suselibwebplinux enterprise server 12 sp50.4.3-4.7.1fixed
Suselibwebplinux enterprise server for sap applications 12 sp50.4.3-4.7.1fixed
Suselibwebplinux enterprise module for package hub 15 sp20.5.0-3.5.1fixed
Suselibwebplinux enterprise module for package hub 15 sp30.5.0-3.5.1fixed
Suselibwebplinux enterprise high performance computing 15-espos0.5.0-3.5.1fixed
Suselibwebplinux enterprise high performance computing 15-ltss0.5.0-3.5.1fixed
Suselibwebplinux enterprise high performance computing 15 sp1-espos0.5.0-3.5.1fixed
Suselibwebplinux enterprise high performance computing 15 sp1-ltss0.5.0-3.5.1fixed
Suselibwebplinux enterprise server 15-ltss0.5.0-3.5.1fixed
Suselibwebplinux enterprise server 15 sp1-bcl0.5.0-3.5.1fixed
Suselibwebplinux enterprise server 15 sp1-ltss0.5.0-3.5.1fixed
Suselibwebplinux enterprise server for sap applications 150.5.0-3.5.1fixed
Suselibwebplinux enterprise server for sap applications 15 sp10.5.0-3.5.1fixed
Suselibwebpmanager proxy 4.00.5.0-3.5.1fixed
Suselibwebpmanager retail branch server 4.00.5.0-3.5.1fixed
Suselibwebpmanager server 4.00.5.0-3.5.1fixed
Suselibwebplinux enterprise workstation extension 15 sp20.5.0-3.5.1fixed
Suselibwebplinux enterprise workstation extension 15 sp30.5.0-3.5.1fixed
Suselibwebpenterprise storage 60.5.0-3.5.1fixed
Opensuselibwebpleap 15.30.5.0-3.5.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibwebpsourcesid0.6.1-2.1not yet assignedNot reportedNot reported
Debianlibwebpsourceforky0.6.1-2.1not yet assignedNot reportedNot reported
Debianlibwebpsourcetrixie0.6.1-2.1not yet assignedNot reportedNot reported
Debianlibwebpsourcebookworm0.6.1-2.1not yet assignedNot reportedNot reported
Ubuntulibwebpdebpro0.4.4-1ubuntu0.1~esm1Not reportedUSN-4971-2Not reported
Ubuntulibwebpdeb18.040.6.1-2ubuntu0.18.04.1Not reportedUSN-4971-1Not reported
Ubuntulibwebpdeb20.040.6.1-2ubuntu0.20.04.1Not reportedUSN-4971-1Not reported
Ubuntulibwebpdebpro0.4.4-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2018-25009Not reported
Ubuntulibwebpdeb18.040.6.1-2ubuntu0.18.04.1Not reportedUBUNTU-CVE-2018-25009Not reported
Ubuntulibwebpdeb20.040.6.1-2ubuntu0.20.04.1Not reportedUBUNTU-CVE-2018-25009Not reported
Suselibwebprpmhpe helion openstack 80.4.3-4.7.1Not reportedSUSE-SU-2021:1830-1Not reported
Suselibwebprpmopenstack cloud 70.4.3-4.7.1Not reportedSUSE-SU-2021:1830-1Not reported
Suselibwebprpmopenstack cloud 80.4.3-4.7.1Not reportedSUSE-SU-2021:1830-1Not reported
Suselibwebprpmopenstack cloud 90.4.3-4.7.1Not reportedSUSE-SU-2021:1830-1Not reported
Suselibwebprpmopenstack cloud crowbar 80.4.3-4.7.1Not reportedSUSE-SU-2021:1830-1Not reported
Suselibwebprpmopenstack cloud crowbar 90.4.3-4.7.1Not reportedSUSE-SU-2021:1830-1Not reported
Suselibwebprpmlinux enterprise server for sap applications 12 sp30.4.3-4.7.1Not reportedSUSE-SU-2021:1830-1Not reported
Suselibwebprpmlinux enterprise server for sap applications 12 sp40.4.3-4.7.1Not reportedSUSE-SU-2021:1830-1Not reported
Suselibwebprpmlinux enterprise software development kit 12 sp50.4.3-4.7.1Not reportedSUSE-SU-2021:1830-1Not reported
Suselibwebprpmlinux enterprise server 12 sp2-bcl0.4.3-4.7.1Not reportedSUSE-SU-2021:1830-1Not reported
Suselibwebprpmlinux enterprise server 12 sp3-ltss0.4.3-4.7.1Not reportedSUSE-SU-2021:1830-1Not reported
Suselibwebprpmlinux enterprise server 12 sp3-bcl0.4.3-4.7.1Not reportedSUSE-SU-2021:1830-1Not reported
Suselibwebprpmlinux enterprise server 12 sp4-ltss0.4.3-4.7.1Not reportedSUSE-SU-2021:1830-1Not reported
Suselibwebprpmlinux enterprise server 12 sp50.4.3-4.7.1Not reportedSUSE-SU-2021:1830-1Not reported
Suselibwebprpmlinux enterprise server for sap applications 12 sp50.4.3-4.7.1Not reportedSUSE-SU-2021:1830-1Not reported
Suselibwebprpmlinux enterprise module for package hub 15 sp20.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Suselibwebprpmlinux enterprise module for package hub 15 sp30.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Suselibwebprpmlinux enterprise high performance computing 15-espos0.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Suselibwebprpmlinux enterprise high performance computing 15-ltss0.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Suselibwebprpmlinux enterprise high performance computing 15 sp1-espos0.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Suselibwebprpmlinux enterprise high performance computing 15 sp1-ltss0.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Suselibwebprpmlinux enterprise server 15-ltss0.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Suselibwebprpmlinux enterprise server 15 sp1-bcl0.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Suselibwebprpmlinux enterprise server 15 sp1-ltss0.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Suselibwebprpmlinux enterprise server for sap applications 150.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Suselibwebprpmlinux enterprise server for sap applications 15 sp10.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Suselibwebprpmmanager proxy 4.00.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Suselibwebprpmmanager retail branch server 4.00.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Suselibwebprpmmanager server 4.00.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Suselibwebprpmlinux enterprise workstation extension 15 sp20.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Suselibwebprpmlinux enterprise workstation extension 15 sp30.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Suselibwebprpmenterprise storage 60.5.0-3.5.1Not reportedSUSE-SU-2021:1860-1Not reported
Opensuselibwebprpmleap 15.30.5.0-3.5.1Not reportedOPENSUSE-SU-2021:1860-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [libwebp]

    Details (2)
    • 1.5.0-0.1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.5.0-0.1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

  • Source package: [libwebp]

    Details (2)
    • 1.5.0-0.1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.5.0-0.1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

  • [libwebp7]Fixed

    Source package: [libwebp]

    Details (6)
    • 1.2.4-0.2+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.2.4-0.2+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.5.0-0.1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.5.0-0.1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.2.4-0.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.2.4-0.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

  • Source package: [libwebp]

    Details (2)
    • 1.5.0-0.1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.5.0-0.1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

  • Source package: [libwebp]

    Details (6)
    • 1.2.4-0.2+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.2.4-0.2+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.5.0-0.1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.5.0-0.1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.2.4-0.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.2.4-0.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

  • Source package: [libwebp]

    Details (6)
    • 1.2.4-0.2+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.2.4-0.2+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.5.0-0.1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.5.0-0.1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.2.4-0.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.2.4-0.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

  • Source package: [libwebp]

    Details (6)
    • 1.2.4-0.2+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.2.4-0.2+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.5.0-0.1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.5.0-0.1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.2.4-0.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.2.4-0.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

  • [webp]Fixed

    Source package: [libwebp]

    Details (6)
    • 1.2.4-0.2+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.2.4-0.2+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.5.0-0.1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.5.0-0.1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.2.4-0.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

    • 1.2.4-0.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · bookworm; dsa · libwebp · debian · 12

[Debian 13 (Trixie)]

  • Source package: [libwebp]

    Details (2)
    • 1.5.0-0.1 · amd64 · trixie

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · 13

    • 1.5.0-0.1 · arm64 · trixie

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · 13

  • Source package: [libwebp]

    Details (2)
    • 1.5.0-0.1 · amd64 · trixie

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · 13

    • 1.5.0-0.1 · arm64 · trixie

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · 13

  • [libwebp7]Fixed

    Source package: [libwebp]

    Details (2)
    • 1.5.0-0.1 · amd64 · trixie

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · 13

    • 1.5.0-0.1 · arm64 · trixie

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · 13

  • Source package: [libwebp]

    Details (2)
    • 1.5.0-0.1 · amd64 · trixie

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · 13

    • 1.5.0-0.1 · arm64 · trixie

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · 13

  • Source package: [libwebp]

    Details (2)
    • 1.5.0-0.1 · amd64 · trixie

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · 13

    • 1.5.0-0.1 · arm64 · trixie

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · 13

  • Source package: [libwebp]

    Details (2)
    • 1.5.0-0.1 · amd64 · trixie

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · 13

    • 1.5.0-0.1 · arm64 · trixie

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · 13

  • Source package: [libwebp]

    Details (2)
    • 1.5.0-0.1 · amd64 · trixie

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · 13

    • 1.5.0-0.1 · arm64 · trixie

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · 13

  • [webp]Fixed

    Source package: [libwebp]

    Details (2)
    • 1.5.0-0.1 · amd64 · trixie

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · 13

    • 1.5.0-0.1 · arm64 · trixie

      Fixed · Fixed: 0.6.1-2.1

      dsa · libwebp · debian · 13

Observed:

References