this post was submitted on 29 Sep 2023
374 points (95.2% liked)

Technology

76361 readers
2389 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
L4s@hackingne.ws
374
UPDATE YOUR BROWSERS IMMEDIATELY. RCE VULNERABILITY DISCOVERED (nvd.nist.gov)
submitted 2 years ago by VitabytesDev@feddit.nl to c/technology@lemmy.world
61 comments fedilink hide all child comments
 

Any Chromium and Firefox browser prior to version 116 will be vulnerable to this, update your browsers.

you are viewing a single comment's thread
view the rest of the comments
[–] Buelldozer@lemmy.today 111 points 2 years ago (2 children)

This is way way wider than just browsers. Anything that can display webp images is vulnerable and that includes things like MS Teams and Twitch.

[–] Lantern@lemmy.world 64 points 2 years ago (3 children)

Further solidifying webp as the worst image format.

[–] chameleon@kbin.social 28 points 2 years ago* (last edited 2 years ago)

The current advisory is in webm (VP8 specifically). The webp one was 2 weeks ago. ...yeah, not a good time for web browsers lately...

(edit: noticed OP actually did link the webp one, I thought it'd be CVE-2023-5217 because that's being linked elsewhere)

[–] Lucidlethargy@sh.itjust.works 15 points 2 years ago* (last edited 2 years ago) (3 children)

WebP is currently the smallest and highest quality format accepted by browsers today. I have no idea why you think so negatively of it, but it's irreplaceable until something better is widely adopted, and thus viable.

It's the best format for websites as of this exact moment.

[–] mlg@lemmy.world 18 points 2 years ago

Highest compression, not highest quality (arguably).

Also heavy compression which takes more resources to display.

Also poor compatibility outside browsers.

afaik it's basically still just VP8 in image format with added metadata, and google refuses to support alternatives because they like to own the browser market.

I think there was gonna be a webp and webm 2, but it never happened.

[–] CriticalMiss@lemmy.world 7 points 2 years ago

The only reason that’s the case is because Google axed the JPEGXL implementation

[–] Espi@lemmy.world 5 points 2 years ago

AVIF is supported everywhere and it's fantastic

[–] synceDD@lemmy.world 0 points 2 years ago (1 children)

? I dont like it because I'm uneducated so it's bad, average voter

[–] seaQueue@lemmy.world 4 points 2 years ago

It's the full disclosure of the ImageIO webp vuln from last week, this is the root cause.