CVE-2023-4863
CVE-2023-4863
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.8 · High · EPSS 100.0% · In KEV · Fix available
- Published
- Updated
Affected products and versions
chrome
- Versions
- ≥ 116.0.5845.187, < 116.0.5845.187: Affected (custom)
No fix published
libwebp
- Versions
- ≥ 1.3.2, < 1.3.2: Affected (custom)
No fix published
chromium Debian:12
- Versions
- 113.0.5672.126-1
- 114.0.5735.106-1
- 114.0.5735.106-1~deb11u1
- 114.0.5735.106-1~deb12u1
- 114.0.5735.133-1
- 114.0.5735.133-1~deb11u1
- 114.0.5735.133-1~deb12u1
- 114.0.5735.198-1
- 114.0.5735.198-1~deb11u1
- 114.0.5735.198-1~deb12u1
- 114.0.5735.90-1
- 114.0.5735.90-2
- 114.0.5735.90-2~deb11u1
- 114.0.5735.90-2~deb12u1
- 115.0.5790.102-1
- 115.0.5790.102-2
- 115.0.5790.170-1
- 115.0.5790.170-1~deb11u1
- 115.0.5790.170-1~deb12u1
- 115.0.5790.98-1
- 115.0.5790.98-1~deb11u1
- 115.0.5790.98-1~deb12u1
- 115.0.5790.98-2
- 116.0.5845.110-1
- 116.0.5845.110-1~deb11u1
- 116.0.5845.110-1~deb12u1
- 116.0.5845.110-2
- 116.0.5845.140-1
- 116.0.5845.140-1~deb11u1
- 116.0.5845.140-1~deb12u1
- 116.0.5845.180-1
- 116.0.5845.180-1~deb11u1
- 116.0.5845.180-1~deb12u1
- 116.0.5845.96-1
- 116.0.5845.96-1~deb11u1
- 116.0.5845.96-1~deb12u1
- 116.0.5845.96-2
- 117.0.5938.62-1~deb11u1
- 117.0.5938.62-1~deb12u1
- Affected ranges
- ECOSYSTEM: < 117.0.5938.62-1
Update to 117.0.5938.62-1
chromium Debian:13
- Affected ranges
- ECOSYSTEM: < 117.0.5938.62-1
Update to 117.0.5938.62-1
chromium Debian:14
- Affected ranges
- ECOSYSTEM: < 117.0.5938.62-1
Update to 117.0.5938.62-1
firefox-esr Debian:12
- Versions
- 102.11.0esr-1
- 102.12.0esr-1
- 102.12.0esr-1~deb10u1
- 102.12.0esr-1~deb11u1
- 102.12.0esr-1~deb12u1
- 102.13.0esr-1
- 102.13.0esr-1~deb10u1
- 102.13.0esr-1~deb11u1
- 102.13.0esr-1~deb12u1
- 102.14.0esr-1~deb10u1
- 102.14.0esr-1~deb11u1
- 102.14.0esr-1~deb12u1
- 102.15.0esr-1~deb10u1
- 102.15.0esr-1~deb11u1
- 102.15.0esr-1~deb12u1
- 102.15.1esr-1~deb10u1
- 102.15.1esr-1~deb11u1
- Affected ranges
- ECOSYSTEM: < 102.15.1esr-1~deb12u1
Update to 102.15.1esr-1~deb12u1
firefox-esr Debian:13
- Affected ranges
- ECOSYSTEM: < 115.2.1esr-1
Update to 115.2.1esr-1
firefox-esr Debian:14
- Affected ranges
- ECOSYSTEM: < 115.2.1esr-1
Update to 115.2.1esr-1
libwebp Debian:12
- Versions
- 1.2.4-0.2
- Affected ranges
- ECOSYSTEM: < 1.2.4-0.2+deb12u1
Update to 1.2.4-0.2+deb12u1
libwebp Debian:13
- Affected ranges
- ECOSYSTEM: < 1.2.4-0.3
Update to 1.2.4-0.3
libwebp Debian:14
- Affected ranges
- ECOSYSTEM: < 1.2.4-0.3
Update to 1.2.4-0.3
thunderbird Debian:12
- Versions
- 1:102.11.0-1
- 1:102.12.0-1
- 1:102.12.0-1~deb10u1
- 1:102.12.0-1~deb11u1
- 1:102.12.0-1~deb12u1
- 1:102.13.0-1
- 1:102.13.0-1~deb10u1
- 1:102.13.0-1~deb11u1
- 1:102.13.0-1~deb12u1
- 1:102.13.1-1
- 1:102.13.1-1~deb10u1
- 1:102.13.1-1~deb11u1
- 1:102.13.1-1~deb12u1
- 1:102.14.0-1~deb10u1
- 1:102.14.0-1~deb11u1
- 1:102.14.0-1~deb12u1
- 1:102.15.0-1~deb10u1
- 1:102.15.0-1~deb11u1
- 1:102.15.0-1~deb12u1
- 1:102.15.1-1~deb10u1
- 1:102.15.1-1~deb11u1
- Affected ranges
- ECOSYSTEM: < 1:102.15.1-1~deb12u1
Update to 1:102.15.1-1~deb12u1
thunderbird Debian:13
- Affected ranges
- ECOSYSTEM: < 1:115.2.2-1
Update to 1:115.2.2-1
thunderbird Debian:14
- Affected ranges
- ECOSYSTEM: < 1:115.2.2-1
Update to 1:115.2.2-1
libwebp-sys2 crates.io
- Affected ranges
- SEMVER: < 0.1.8
Update to 0.1.8
libwebp-sys crates.io
- Affected ranges
- SEMVER: < 0.9.3
Update to 0.9.3
electron npm
- Affected ranges
- SEMVER: ≥ 22.0.0, < 22.3.24
Update to 22.3.24
electron npm
- Affected ranges
- SEMVER: ≥ 24.0.0, < 24.8.3
Update to 24.8.3
electron npm
- Affected ranges
- SEMVER: ≥ 25.0.0, < 25.8.1
Update to 25.8.1
electron npm
- Affected ranges
- SEMVER: ≥ 26.0.0, < 26.2.1
Update to 26.2.1
electron npm
- Affected ranges
- SEMVER: ≥ 27.0.0-beta.1, < 27.0.0-beta.2
Update to 27.0.0-beta.2
skiasharp NuGet
- Versions
- 2.80.0
- 2.80.1
- 2.80.2
- 2.80.3
- 2.80.4
- 2.88.0
- 2.88.1
- 2.88.2
- 2.88.3
- 2.88.4
- 2.88.5
- Affected ranges
- ECOSYSTEM: ≥ 2.0.0, < 2.88.6
Update to 2.88.6
github.com/chai2010/webp Go
- Affected ranges
- SEMVER: ≥ 1.1.2, < 1.4.0
Update to 1.4.0
pillow PyPI
- Versions
- 1.0
- 1.1
- 1.2
- 1.3
- 1.4
- 1.5
- 1.6
- 1.7.0
- 1.7.1
- 1.7.2
- 1.7.3
- 1.7.4
- 1.7.5
- 1.7.6
- 1.7.7
- 1.7.8
- 10.0.0
- 2.0.0
- 2.1.0
- 2.2.0
- 2.2.1
- 2.2.2
- 2.3.0
- 2.3.1
- 2.3.2
- 2.4.0
- 2.5.0
- 2.5.1
- 2.5.2
- 2.5.3
- 2.6.0
- 2.6.1
- 2.6.2
- 2.7.0
- 2.8.0
- 2.8.1
- 2.8.2
- 2.9.0
- 3.0.0
- 3.1.0
- 3.1.0.rc1
- 3.1.0rc1
- 3.1.1
- 3.1.2
- 3.2.0
- 3.3.0
- 3.3.1
- 3.3.2
- 3.3.3
- 3.4.0
- 3.4.1
- 3.4.2
- 4.0.0
- 4.1.0
- 4.1.1
- 4.2.0
- 4.2.1
- 4.3.0
- 5.0.0
- 5.1.0
- 5.2.0
- 5.3.0
- 5.4.0
- 5.4.0.dev0
- 5.4.1
- 6.0.0
- 6.1.0
- 6.2.0
- 6.2.1
- 6.2.2
- 7.0.0
- 7.1.0
- 7.1.1
- 7.1.2
- 7.2.0
- 8.0.0
- 8.0.1
- 8.1.0
- 8.1.1
- 8.1.2
- 8.2.0
- 8.3.0
- 8.3.1
- 8.3.2
- 8.4.0
- 9.0.0
- 9.0.1
- 9.1.0
- 9.1.1
- 9.2.0
- 9.3.0
- 9.4.0
- 9.5.0
- Affected ranges
- ECOSYSTEM: < 10.0.1
Update to 10.0.1
Original sources
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
- https://crbug.com/1479274
- https://en.bandisoft.com/honeyview/history/
- https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
- https://security-tracker.debian.org/tracker/CVE-2023-4863
- https://bugzilla.suse.com/show_bug.cgi?id=1215231
- https://news.ycombinator.com/item?id=37478403
- https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/
- https://www.debian.org/security/2023/dsa-5496
- https://www.debian.org/security/2023/dsa-5497
- https://lists.fedoraproject.org/archives/list/[email protected]/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/
- https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/
- https://www.debian.org/security/2023/dsa-5498
- https://security.gentoo.org/glsa/202309-05
- https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
- https://nvd.nist.gov/vuln/detail/CVE-2023-4863