News for hackers. Stuff that matters.

A comment on Google assigns a CVE for libwebp and gives it a 10.0 score. Parent comment

Re:Google assigns a CVE for libwebp and gives it a 10.0 score by changelink on Tuesday September 26, 2023 @10:11AM (#37659610)
I just checked, and in the last 30 minutes a update has become available for my Pixel 5.

The security bulletin doesn't reference this CVE specifically but does mention a critical vulnerability that could lead to RCE.

[ Parent | on HN ]
Re:Google assigns a CVE for libwebp and gives it a 10.0 score by jacquesm on Tuesday September 26, 2023 @10:31AM (#37659942)
The problem is that they'll use the opportunity to schlep a bunch of non-security related stuff into the update as well. That's the thing that really bothers me about these, that you can't say just the security patches and hold the telemetry/marketing/spyware/adware/crapware/malware/etc.
[ Parent | on HN ]
Re:Google assigns a CVE for libwebp and gives it a 10.0 score by izacus on Tuesday September 26, 2023 @11:53AM (#37661174)
Updates outside the quarterly feature drops on Pixels are pretty much exclusively security patches so I have no idea what you're talking about.
[ Parent | on HN ]
Re:Google assigns a CVE for libwebp and gives it a 10.0 score by jacquesm on Tuesday September 26, 2023 @12:03PM (#37661337)
This is what I'm talking about:

https://support.google.com/product-documentation/answer/1141...

Good luck setting things up in such a way that you only get security patches and not a whole bunch of 'improvements' to go with them.

[ Parent | on HN ]