I recently saw an article (https://stackdiary.com/heap-buffer-overflow-in-libwebp-cve-2023-5129/) that said WEBP images could be a huge security hole right now and I know Lemmy uses a lot of WEBP images.
I’m not sure how long this has been known, so maybe the Liftoff devs already took care of it. Does anyone know if Liftoff has already made the necessary patches?
You are viewing a single thread.
View all comments 
19 points
The vulnerability is fixed within pict-rs, which is part of lemmy instance default setup. It’s such a coincidence that I’ve just updated it on mine.
TL;DR - it is not up to liftoff to fix it.
6 points
