4 ms·
How many packages send untrusted input to the encoder though? It's a vulnerability in the context of a browser because the browser provides to any page, the ab
by cwillu 3y ago
How many packages send untrusted input to the encoder though? It's a vulnerability in the context of a browser because the browser provides to any page, the ability to send arbitrary malformed data to the encoder.
Many applications present images from untrusted sources. I'm having a hard time thinking of a single application that will _encode_ untrusted input, beyond a browser.
- masklinn 3y agoI would assume any website which stores and displays video transcodes them to known internal specs and format. YouTube certainly does.
- cwillu 3y agoIt's a vulnerability that needs to be patched and may have major impacts on some services. It's _not_ a vulnerability that needs to be mentioned alongside the webp cve lest the public be caught unaware of something they need to update on every phone and laptop they own.