[Question] Security Vulnerability found in libwebp library

[jackyk-cognitoiq]

Discussed in https://github.com/googlesamples/mlkit/discussions/738

^{Originally posted by jackyk-cognitoiq September 28, 2023} I noticed there has been a security vulnerability found in the libwebp library (https://nvd.nist.gov/vuln/detail/CVE-2023-4863#range-9599713). Can someone confirm whether the Google ML Kit library uses it or not?

I can see it listed in the licenses as using v0.2. Is that the version the library is using?

I believe there is already a patch for the libwebp library to address this (v1.3.2), if the Google ML Kit library do use libwebp, is there any plans for it to be updated?

[zhouyiself]

Thanks for the report! Can you also share which ML Kit SDK's licenses mention this library?

[jackyk-cognitoiq]

It is listed in the licenses for the following in the ML Kit SDK :

• GoogleMLKit/MLKitCore
• MLKitBarcodeScanning
• MLKitCommon
• MLKitVision

[zhouyiself]

Which platform you're referring to? Android or iOS?

[jackyk-cognitoiq]

I'm referring to iOS.

[miworking3]

ML Kit is scheduled for a public release at the end of February 2024, carrying libwebp version 1.3.2. Please stay tuned for updates.