Review/merge any nixpkgs PR that you see pending in the task list below.See below for a list of all the known applications that need an update and their status. Each of these need to be updated separately by nixpkgs maintainers. Some applications bundle their own version of libwebp instead of using the system version (including some other web browsers in nixpkgs: Brave, Tor Browser, etc.).

Direct dependents of the system libwebp are also not vulnerable anymore. Current statusįirefox and Chromium are not vulnerable anymore as of in unstable and 23.05. This vulnerability was very shortly referred to as CVE-2023-5129, but that second CVE for the same vulnerability has since been withdrawn. Chrome has rated this vulnerability as critical severity and has indicated that they have evidence some actors are already exploiting it in the wild. This impacts pretty much all web browsers, as well as other software which might process or display untrusted images (image editing software, email clients, chat clients, social media clients, etc.). Feel free to send questions my way and/or contribute via comments in this issue! What's CVE-2023-4863Ī buffer overflow in libwebp which allows a malicious actor to potentially get code execution in software that displays a specially crafted image file. Filing this issue to track CVE-2023-4863 related actions in nixpkgs.

Joplin 2.12.16 for windows instal free