Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to poten
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 117.0.5938.132, 1.13.1, 22.3.25, 24.8.5, 25.8.4, and 2 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
This vulnerability affects Google Chrome and the libvpx video codec library, which are used for processing VP8 video encoding. A remote attacker could potentially exploit it by tricking a user into opening a specially crafted web page, which could corrupt memory and possibly lead to arbitrary code execution.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Google Chrome
From 117.0.5938.132 · fixed in 117.0.5938.132
- Google libvpx
From 1.13.1 · fixed in 1.13.1
- electronnpm
fixed in 22.3.25
- electronnpm
From 24.0.0 · fixed in 24.8.5
- electronnpm
From 25.0.0 · fixed in 25.8.4
- electronnpm
From 26.0.0 · fixed in 26.2.4
- electronnpm
From 27.0.0-alpha.1 · fixed in 27.0.0-beta.8
References 25
chromereleases.googleblog.com
crbug.com
openwall.com
- lists/oss-security/2023/09/28/5
- lists/oss-security/2023/09/28/6
- lists/oss-security/2023/09/29/1
- lists/oss-security/2023/09/29/2
- lists/oss-security/2023/09/29/7
- lists/oss-security/2023/09/29/9
- lists/oss-security/2023/09/28/5
- lists/oss-security/2023/09/29/11
- lists/oss-security/2023/09/29/12
- lists/oss-security/2023/09/29/14
- lists/oss-security/2023/09/30/1
mozilla.org
security-tracker.debian.org
bugzilla.redhat.com
stackdiary.com
pastebin.com
GitHub · webmproject/libvpx
lists.debian.org
Questions about CVE-2023-5217
What does this mean?
A heap buffer overflow in libvpx's VP8 encoding can be triggered by specific handling of an attacker-controlled VP8 media stream. It can overflow a heap buffer in the content process and lead to heap corruption.Source: mozilla.org
Am I affected, and how do I check?
The advisory names Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1. The product data also lists Electron ranges ending at 22.3.25, 24.8.5, 25.8.4, 26.2.4, and 27.0.0-beta.8. To check a Chrome install, compare its version under the browser's About page against 117.0.5938.132; for libvpx, check the library version it was built with.Source: mozilla.org
What should I do about it?
Move Chrome to 117.0.5938.132 or later, and move libvpx and Electron to the fixed versions listed for their branch. The fix data also lists Firefox 118.0.1, Firefox ESR 115.3.1, and Thunderbird 115.3.1, which do not match the Chrome and libvpx entries.Source: mozilla.org
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-10-02, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data