search

rive-app / rive-ios

iOS runtime for Rive
MIT License
462 stars 53 forks source link

Rive-Skia using outdated libwebp version prone to a security issue CVE-2023-5217, CVE-2023-4863 #328

Open jaichaudhry opened 1 month ago

jaichaudhry commented 1 month ago

Description

Rive framework uses Rive-Skia, which is using outdated libwebp version which is prone to a grave security issue CVE issue link. Please also refer this link

Provide a Repro

Any latest Rive framework will have this issue, Rive example is also a good option.

Additional context

This is a very dangerous security problem and makes all the app using Rive prone to this security problem. The Skia branch Rive is using is very old and does not contain the latest Version libwebp version of 1.4.0. (This issue was fixed in libwebp 1.3.2). highly recommend updating the libwebp version being used in Skia branch.

Here is one more helpful link

jaichaudhry commented 1 week ago

@mjtalbot Could you please take a look at this, this is very important security fix that should be rolled out