what is the webp vulnerability? (lemmy.ml)

submitted 9 months ago by jackpot@lemmy.ml to c/asklemmy@lemmy.ml

18 comments fedilink hide all child comments

i downloaded a webp image a few days ago is my pc compromised, very confused apologies

top 18 comments

sorted by: hot top controversial new old

[-] skip0110@lemm.ee 35 points 9 months ago

A malformed (attacker crafted) webp file could cause Chrome (or other Chrome based browsers) to execute arbitrary code when rendering it. The file might be embedded in a web page you view. Other applications that use Skia for graphics are theoretically affected too.

[-] jackpot@lemmy.ml 16 points 9 months ago

oh i use firefox

[-] Atemu@lemmy.ml 26 points 9 months ago

It's a bug in the webp library; everything that can decode webp is affected.

[-] boatswain@infosec.pub 6 points 9 months ago

The one s couple of weeks ago also affected Firefox: https://thehackernews.com/2023/09/mozilla-rushes-to-patch-webp-critical.html?m=1

[+] Granixo@feddit.cl -16 points 9 months ago

The internet needs to switch to .svg

[-] Knusper@feddit.de 51 points 9 months ago

SVG is for vector graphics, i.e. anything that can be described with lines and shapes, like logos or most icons.
WebP on the other hand is for raster graphics. For example, cameras create raster graphics.

So, while SVG may be able to replace WebP for some use-cases, it makes no sense to generally switch to SVG.
A suitable, better replacement for WebP is JPEG XL.

[-] sxan@midwest.social 8 points 9 months ago

In oelden days, I once made an entire (small) web site out of SVG. All the layout, everything; it was before responsive design, and before SVG had text wrap. It had animations and everything.

In a way, it was pretty cool; like PDF web pages. Everything was always perfectly and faithfully laid out. But the downside was that everything was always perfectly laid out ... for exactly one display dimensions.

I still have a soft spot in my heart for SVG. I wish it were more widely used, and that svgz was more well supported. But yeah, you're right: it's not the best choice for a lot of graphics.

[-] Granixo@feddit.cl 2 points 9 months ago

Haven't heard of JPEG XL, will investigate further. 🤓

Thanks! 😃

[-] thepreciousboar@lemm.ee 1 points 9 months ago

What does jpeg XL differ from normal jpeg? Wansn't webp introduced to replace jpeg?

[-] Knusper@feddit.de 9 points 9 months ago* (last edited 9 months ago)

JPEG XL is just a new standard from the Joint Photographic Experts Group. It doesn't have much to do with the original JPEG standard from 1992. For example, JPEG XL also supports lossless compression, which PNG was traditionally used for.

And yes, WebP was developed to supersede JPEG, however it was developed at Google without much input from the industry. As such, it never gained particularly widespread support.
JPEG XL is a newer standard compared to WebP, developed in a joint venture by more of the industry (including Google), and from what I've heard, it makes several significant improvements compared to WebP.

It is a very new standard, so it probably is still behind WebP in terms of adoption, but I'd expect that to flip pretty soon.

Personal opinion: I just think WebP is poop.
You can have images with huge resolutions that still look incredibly blurry.

[-] thepreciousboar@lemm.ee 2 points 9 months ago

Reminds me of the xkcd about standards

https://xkcd.com/927/

[-] nutbutter@discuss.tchncs.de 1 points 9 months ago

What's better? Avif or jepg xl?

[-] Knusper@feddit.de 4 points 9 months ago

Honestly, I have no idea. It sounds like AVIF also has wide industry support and is generally quite proficient.

But JPEG XL likely wouldn't have been created, if AVIF was perfect. Wikipedia says:

The [JPEG XL] standard is expected to outperform the still image compression performance shown by HEIC, AVIF, WebP, and JPEG 2000. It also provides efficient lossless recompression options for images in the traditional/legacy JPEG format.

I'm guessing, AVIF was created, because it basically already existed. It's using the AV1 video codec to encode a single-frame video and that just happened to be better than the competition.
JPEG XL being more focused on those still images could obviously still outperform it. I guess, we'll have to see.

For right now, though, yeah, JPEG XL might still be too young and AVIF therefore the better choice.

[-] thepreciousboar@lemm.ee 1 points 9 months ago

Reminds me of the xkcd about standards

https://xkcd.com/927/

[-] jackpot@lemmy.ml 2 points 9 months ago

whats that

[-] Brkdncr@artemis.camp 9 points 9 months ago

Anything that decodes webp images is vulnerable to an attack. Unless the vendor of the app says they patched it, assume they have not.

Browsers are obvious, but lots of other things decodes images. Your text messaging app, atm machines, vehicle infotainment, the ticket swipe at the airport. Anything designed to capture, process, or display anything is suspect, along with the underlying os of anything.

[-] mp3@lemmy.ca 2 points 9 months ago

So many apps that we use nowadays are based on Electron, which is a web browser by itself. Those using Discord, Spotify, etc will want to update their app ASAP.

[-] peter@feddit.uk 8 points 9 months ago

You're probably alright. Just make sure your stuff is up to date and if you notice any weird behaviour do a virus scan.

this post was submitted on 30 Sep 2023

34 points (87.0% liked)

Asklemmy

42432 readers

1226 users here now

A loosely moderated place to ask open-ended questions

Search asklemmy 🔍

If your post meets the following criteria, it's welcome here!

Open-ended question
Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
Not ad nauseam inducing: please make sure it is a question that would be new to most members
An actual topic of discussion

Looking for support?

Looking for a community?

Lemmyverse: community search
sub.rehab: maps old subreddits to fediverse options, marks official as such
!lemmy411@lemmy.ca: a community for finding communities

~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~

founded 5 years ago

MODERATORS

ada@lemmy.blahaj.zone

AdaShovelace@lemmy.ml