I guess this ships the fix for the webp zero-day? That was pretty quick of them, massive props ๐
this post was submitted on 12 Sep 2023
208 points (98.6% liked)
Firefox
17794 readers
28 users here now
A place to discuss the news and latest developments on the open-source browser Firefox
founded 4 years ago
MODERATORS
It was that, the link about the security fix is working now.
Based what was said in the security fix link. I see nothing about a fix.
If you're looking for the details of how it was fixed, you'd need to look elsewhere such as: https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
Anyone who knows things got a laymen explanation for this zeroday?
In my understanding: What happens is a Heap Buffer Overflow. The Heap is a style of memory and a Buffer is just a chunk of storage where you place something that is a work in progress. (Think a Youtube video buffering, you are waiting for more data to come down so you can play the video)
The WebP image type has the unintended ability to write to more memory than the OS assigns it. It can 'overflow'.
If you craft a WebP image file just right, you can write malicious code to a location in memory that the OS may think is executable code and then run it, all without the user knowing.
What really surprised me is how fast Fennec F-Droid was updated.
Debian had the update this a.m.