Vulnerable shared library might make fresco vulnerable. Can you help upgrade to patch versions?

[HelenParr]

Hi, @oprisnik , @defHLT , I'd like to report a vulnerability issue in com.facebook.fresco:webpsupport:2.6.0.

Issue Description

com.facebook.fresco:webpsupport:2.6.0 directly depends on 4 C libraries (.so) cross many platforms(such as x86-64, x86, arm64, armhf). However, I noticed that the shared library is vulnerable, containing the following CVEs:

libstatic-webp.so from C project libjpeg-turbo(version:1.5.3) exposed 1 vulnerabilities: CVE-2018-14498

Suggested Vulnerability Patch Versions

libjpeg-turbo has fixed the vulnerabilities in versions >=2.1.0

Java build tools cannot report vulnerable C libraries, which may induce potential security issues to many downstream Java projects. Could you please upgrade the above shared libraries to their patch versions?

Thanks for your help~ Best regards, Helen Parr

[Mezzle]

Duplicates https://github.com/facebook/fresco/issues/2482