CVE-2023-5217

HIGH CISA KEV EPSS 98.2%

Published Sep 28, 20232y ago · Modified Jun 17, 20262w ago

8.8 CVSS 3.1

High

Find Similar

Published Sep 28, 2023 2y ago

Last Modified Jun 17, 2026 2w ago

KEV Listed Oct 2, 2023 2y ago

KEV Due Oct 23, 2023 983d overdue

Description

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS Details

Base Score

8.8

Exploitability

2.8

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

CISA Known Exploited Overdue 983d

Added: Oct 2, 2023
Due: Oct 23, 2023

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS Exploit Probability

98.2% percentile

Exploit & Patch Status

Actively Exploited (KEV)

Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 21

Vendor	Product	Version	Range
webmproject	libvpx	*	<1.13.1
microsoft	edge	116.0.1938.98	any
microsoft	edge	117.0.2045.47	any
microsoft	edge_chromium	116.0.5845.229	any
microsoft	edge_chromium	117.0.5938.132	any
mozilla	firefox	*	<115.3.1
mozilla	firefox	*	<118.0.1
mozilla	firefox	*	<118.1
mozilla	thunderbird	*	<115.3.1
fedoraproject	fedora	37	any
fedoraproject	fedora	38	any
fedoraproject	fedora	39	any
debian	debian_linux	10.0	any
debian	debian_linux	11.0	any
debian	debian_linux	12.0	any
apple	ipados	*	≥17.0 – <17.0.3
apple	ipados	16.7	any
apple	iphone_os	*	≥17.0 – <17.0.3
apple	iphone_os	16.7	any
google	chrome	*	<117.0.5938.132
redhat	enterprise_linux	9.0	any

References 53

seclists.org http://seclists.org/fulldisclosure/2023/Oct/12

Mailing ListThird Party Advisory
seclists.org http://seclists.org/fulldisclosure/2023/Oct/16

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/09/28/5

Mailing ListPatchThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/09/28/6

Mailing ListPatchThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/09/29/1

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/09/29/11

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/09/29/12

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/09/29/14

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/09/29/2

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/09/29/7

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/09/29/9

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/09/30/1

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/09/30/2

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/09/30/3

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/09/30/4

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/09/30/5

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/10/01/1

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/10/01/2

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/10/01/5

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/10/02/6

Mailing ListThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/10/03/11

Mailing ListThird Party Advisory
arstechnica.com https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/

Third Party Advisory
bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2241191

Issue TrackingThird Party Advisory
chromereleases.googleblog.com https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html

Vendor Advisory
crbug.com https://crbug.com/1486441

ExploitIssue Tracking
github.com https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590

Patch
github.com https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282

Patch
github.com https://github.com/webmproject/libvpx/releases/tag/v1.13.1

Release Notes
github.com https://github.com/webmproject/libvpx/tags

Product
lists.debian.org https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html

Mailing List
lists.debian.org https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html

Mailing List
lists.debian.org https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html

Mailing List
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/

Mailing List
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/

Mailing List
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/

Mailing List
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/

Mailing List
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/

Mailing List
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/

Mailing List
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/

Mailing List
pastebin.com https://pastebin.com/TdkC4pDv

Not Applicable
security-tracker.debian.org https://security-tracker.debian.org/tracker/CVE-2023-5217

Third Party Advisory
security.gentoo.org https://security.gentoo.org/glsa/202310-04

Third Party Advisory
security.gentoo.org https://security.gentoo.org/glsa/202401-34

Third Party Advisory
stackdiary.com https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/

Third Party Advisory
support.apple.com https://support.apple.com/kb/HT213961

Third Party Advisory
support.apple.com https://support.apple.com/kb/HT213972

Third Party Advisory
twitter.com https://twitter.com/maddiestone/status/1707163313711497266

Third Party Advisory
cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5217

US Government Resource
debian.org https://www.debian.org/security/2023/dsa-5508

Mailing List
debian.org https://www.debian.org/security/2023/dsa-5509

Mailing List
debian.org https://www.debian.org/security/2023/dsa-5510

Mailing List
mozilla.org https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/

Third Party Advisory
openwall.com https://www.openwall.com/lists/oss-security/2023/09/28/5

Mailing ListThird Party Advisory

Remediation

openwall.com http://www.openwall.com/lists/oss-security/2023/09/28/5

Mailing ListPatchThird Party Advisory
openwall.com http://www.openwall.com/lists/oss-security/2023/09/28/6

Mailing ListPatchThird Party Advisory
github.com https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590

Patch
github.com https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282

Patch