high8.8Known exploited
CVE-2023-5217
Electron affected by libvpx's heap buffer overflow in vp8 encoding
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-10-02. Federal due date: 2023-10-23.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Impact
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | electron | < 22.3.25 | 22.3.25 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Webmproject | Libvpx | before 1.13.1 |
| Microsoft | Edge | Versions 116.0.1938.98, 117.0.2045.47 |
| Microsoft | Edge Chromium | Versions 116.0.5845.229, 117.0.5938.132 |
| Mozilla | Firefox | before 115.3.1 before 118.0.1 before 118.1 |
| Mozilla | Thunderbird | before 115.3.1 |
| Fedoraproject | Fedora | Versions 37, 38, 39 |
| Debian | Debian Linux | Versions 10.0, 11.0, 12.0 |
| Apple | Ipados | from 17.0 before 17.0.3 Version 16.7 |
| Apple | Iphone Os | from 17.0 before 17.0.3 Version 16.7 |
| Chrome | before 117.0.5938.132 | |
| Redhat | Enterprise Linux | Version 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- CISA KEV catalog
- http://seclists.org/fulldisclosure/2023/Oct/12
- http://seclists.org/fulldisclosure/2023/Oct/16
- http://www.openwall.com/lists/oss-security/2023/09/28/5
- http://www.openwall.com/lists/oss-security/2023/09/28/6
- http://www.openwall.com/lists/oss-security/2023/09/29/1
- http://www.openwall.com/lists/oss-security/2023/09/29/11
- http://www.openwall.com/lists/oss-security/2023/09/29/12
- http://www.openwall.com/lists/oss-security/2023/09/29/14
- http://www.openwall.com/lists/oss-security/2023/09/29/2
- http://www.openwall.com/lists/oss-security/2023/09/29/7
- http://www.openwall.com/lists/oss-security/2023/09/29/9
- http://www.openwall.com/lists/oss-security/2023/09/30/1
- http://www.openwall.com/lists/oss-security/2023/09/30/2
- http://www.openwall.com/lists/oss-security/2023/09/30/3
- http://www.openwall.com/lists/oss-security/2023/09/30/4
- http://www.openwall.com/lists/oss-security/2023/09/30/5
- http://www.openwall.com/lists/oss-security/2023/10/01/1
- http://www.openwall.com/lists/oss-security/2023/10/01/2
- http://www.openwall.com/lists/oss-security/2023/10/01/5
- http://www.openwall.com/lists/oss-security/2023/10/02/6
- http://www.openwall.com/lists/oss-security/2023/10/03/11
- https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/
- https://bugzilla.redhat.com/show_bug.cgi?id=2241191
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- https://crbug.com/1486441