CVE-2023-5217
CVE-2023-5217
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 · High · EPSS 49.0% · In KEV · Fix available
- Published
- Updated
Affected products and versions
chrome
- Versions
- ≥ 117.0.5938.132, < 117.0.5938.132: Affected (custom)
No fix published
libvpx
- Versions
- ≥ 1.13.1, < 1.13.1: Affected (custom)
No fix published
chromium Debian:12
- Versions
- 113.0.5672.126-1
- 114.0.5735.106-1
- 114.0.5735.106-1~deb11u1
- 114.0.5735.106-1~deb12u1
- 114.0.5735.133-1
- 114.0.5735.133-1~deb11u1
- 114.0.5735.133-1~deb12u1
- 114.0.5735.198-1
- 114.0.5735.198-1~deb11u1
- 114.0.5735.198-1~deb12u1
- 114.0.5735.90-1
- 114.0.5735.90-2
- 114.0.5735.90-2~deb11u1
- 114.0.5735.90-2~deb12u1
- 115.0.5790.102-1
- 115.0.5790.102-2
- 115.0.5790.170-1
- 115.0.5790.170-1~deb11u1
- 115.0.5790.170-1~deb12u1
- 115.0.5790.98-1
- 115.0.5790.98-1~deb11u1
- 115.0.5790.98-1~deb12u1
- 115.0.5790.98-2
- 116.0.5845.110-1
- 116.0.5845.110-1~deb11u1
- 116.0.5845.110-1~deb12u1
- 116.0.5845.110-2
- 116.0.5845.140-1
- 116.0.5845.140-1~deb11u1
- 116.0.5845.140-1~deb12u1
- 116.0.5845.180-1
- 116.0.5845.180-1~deb11u1
- 116.0.5845.180-1~deb12u1
- 116.0.5845.96-1
- 116.0.5845.96-1~deb11u1
- 116.0.5845.96-1~deb12u1
- 116.0.5845.96-2
- 117.0.5938.132-1~deb11u1
- 117.0.5938.62-1
- 117.0.5938.62-1~deb11u1
- 117.0.5938.62-1~deb12u1
- 117.0.5938.92-1
- Affected ranges
- ECOSYSTEM: < 117.0.5938.132-1~deb12u1
Update to 117.0.5938.132-1~deb12u1
chromium Debian:13
- Affected ranges
- ECOSYSTEM: < 117.0.5938.132-1
Update to 117.0.5938.132-1
chromium Debian:14
- Affected ranges
- ECOSYSTEM: < 117.0.5938.132-1
Update to 117.0.5938.132-1
firefox-esr Debian:12
- Versions
- 102.11.0esr-1
- 102.12.0esr-1
- 102.12.0esr-1~deb10u1
- 102.12.0esr-1~deb11u1
- 102.12.0esr-1~deb12u1
- 102.13.0esr-1
- 102.13.0esr-1~deb10u1
- 102.13.0esr-1~deb11u1
- 102.13.0esr-1~deb12u1
- 102.14.0esr-1~deb10u1
- 102.14.0esr-1~deb11u1
- 102.14.0esr-1~deb12u1
- 102.15.0esr-1~deb10u1
- 102.15.0esr-1~deb11u1
- 102.15.0esr-1~deb12u1
- 102.15.1esr-1~deb10u1
- 102.15.1esr-1~deb11u1
- 102.15.1esr-1~deb12u1
- 115.0.2esr-1
- 115.1.0esr-1
- 115.10.0esr-1
- 115.10.0esr-1~deb10u1
- 115.10.0esr-1~deb11u1
- 115.10.0esr-1~deb12u1
- 115.11.0esr-1
- 115.11.0esr-1~deb10u1
- 115.11.0esr-1~deb11u1
- 115.11.0esr-1~deb12u1
- 115.12.0esr-1
- 115.12.0esr-1~deb10u1
- 115.12.0esr-1~deb11u1
- 115.12.0esr-1~deb12u1
- 115.13.0esr-1
- 115.13.0esr-1~deb11u1
- 115.13.0esr-1~deb12u1
- 115.13.0esr-2
- 115.14.0esr-1
- 115.14.0esr-1~deb11u1
- 115.14.0esr-1~deb12u1
- 115.15.0esr-1
- 115.15.0esr-1~deb11u1
- 115.15.0esr-1~deb12u1
- 115.2.0esr-1
- 115.2.1esr-1
- 115.3.0esr-1
- 115.3.0esr-1~deb10u1
- 115.3.0esr-1~deb11u1
- 115.3.0esr-1~deb12u1
- 115.3.1esr-1~deb10u1
- 115.3.1esr-1~deb11u1
- 115.4.0esr-1
- 115.4.0esr-1~deb10u1
- 115.4.0esr-1~deb11u1
- 115.4.0esr-1~deb12u1
- 115.5.0esr-1
- 115.5.0esr-1~deb10u1
- 115.5.0esr-1~deb11u1
- 115.5.0esr-1~deb12u1
- 115.6.0esr-1
- 115.6.0esr-1~deb10u1
- 115.6.0esr-1~deb11u1
- 115.6.0esr-1~deb12u1
- 115.7.0esr-1
- 115.7.0esr-1~deb10u1
- 115.7.0esr-1~deb11u1
- 115.7.0esr-1~deb12u1
- 115.8.0esr-1
- 115.8.0esr-1~deb10u1
- 115.8.0esr-1~deb11u1
- 115.8.0esr-1~deb12u1
- 115.9.0esr-1
- 115.9.0esr-1~deb11u1
- 115.9.0esr-1~deb12u1
- 115.9.0esr-2
- 115.9.1esr-1
- 115.9.1esr-1~deb10u1
- 115.9.1esr-1~deb11u1
- 115.9.1esr-1~deb12u1
- 128.10.0esr-1
- 128.10.0esr-1~deb12u1
- 128.10.1esr-1
- 128.10.1esr-1~deb11u1
- 128.10.1esr-1~deb12u1
- 128.11.0esr-1
- 128.11.0esr-1~deb11u1
- 128.11.0esr-1~deb12u1
- 128.12.0esr-1
- 128.12.0esr-1~deb11u1
- 128.12.0esr-1~deb12u1
- 128.13.0esr-1
- 128.13.0esr-1~deb11u1
- 128.13.0esr-1~deb12u1
- 128.14.0esr-1
- 128.14.0esr-1~deb11u1
- 128.14.0esr-1~deb12u1
- 128.14.0esr-1~deb13u1
- 128.3.0esr-1
- 128.3.0esr-1~deb11u1
- 128.3.0esr-1~deb11u2
- 128.3.0esr-1~deb12u1
- 128.3.0esr-2
- 128.3.1esr-1
- 128.3.1esr-1~deb11u1
- 128.3.1esr-1~deb12u1
- 128.3.1esr-2
- 128.4.0esr-1
- 128.4.0esr-1~deb11u1
- 128.4.0esr-1~deb12u1
- 128.5.0esr-1
- 128.5.0esr-1~deb11u1
- 128.5.0esr-1~deb12u1
- 128.5.1esr-1
- 128.6.0esr-1
- 128.6.0esr-1~deb11u1
- 128.6.0esr-1~deb11u2
- 128.6.0esr-1~deb11u3
- 128.6.0esr-1~deb12u1
- 128.6.0esr-2
- 128.6.0esr-3
- 128.6.0esr-4
- 128.7.0esr-1
- 128.7.0esr-1~deb11u1
- 128.7.0esr-1~deb12u1
- 128.8.0esr-1
- 128.8.0esr-1~deb11u1
- 128.8.0esr-1~deb12u1
- 128.9.0esr-1
- 128.9.0esr-1~deb11u1
- 128.9.0esr-1~deb12u1
- 128.9.0esr-2
- 140.10.0esr-1
- 140.10.0esr-1~deb11u1
- 140.10.0esr-1~deb12u1
- 140.10.0esr-1~deb13u1
- 140.10.1esr-1
- 140.10.1esr-1~deb11u1
- 140.10.1esr-1~deb12u1
- 140.10.1esr-1~deb13u1
- 140.10.2esr-1
- 140.10.2esr-1~deb11u1
- 140.10.2esr-1~deb12u1
- 140.10.2esr-1~deb13u1
- 140.11.0esr-1
- 140.11.0esr-1~deb11u1
- 140.11.0esr-1~deb12u1
- 140.11.0esr-1~deb13u1
- 140.12.0esr-1
- 140.12.0esr-1~deb11u1
- 140.12.0esr-1~deb12u1
- 140.12.0esr-1~deb13u1
- 140.13.0esr-1
- 140.13.0esr-1~deb11u1
- 140.13.0esr-1~deb12u1
- 140.13.0esr-1~deb13u1
- 140.13.0esr-2
- 140.14.0esr-1~deb11u1
- 140.14.0esr-1~deb12u1
- 140.14.0esr-1~deb13u1
- 140.14.0esr-2
- 140.15.0esr-1
- 140.15.0esr-1~deb12u1
- 140.15.0esr-1~deb13u1
- 140.16.0esr-1
- 140.16.0esr-1~deb12u1
- 140.16.0esr-1~deb13u1
- 140.3.0esr-1
- 140.3.0esr-1~deb11u1
- 140.3.0esr-1~deb11u2
- 140.3.0esr-1~deb12u1
- 140.3.0esr-1~deb13u1
- 140.3.0esr-2
- 140.3.1esr-1
- 140.3.1esr-1~deb11u1
- 140.3.1esr-1~deb12u1
- 140.3.1esr-1~deb13u1
- 140.3.1esr-2
- 140.4.0esr-1
- 140.4.0esr-1~deb11u1
- 140.4.0esr-1~deb12u1
- 140.4.0esr-1~deb13u1
- 140.5.0esr-1
- 140.5.0esr-1~deb11u1
- 140.5.0esr-1~deb12u1
- 140.5.0esr-1~deb13u1
- 140.6.0esr-1
- 140.6.0esr-1~deb11u1
- 140.6.0esr-1~deb12u1
- 140.6.0esr-1~deb13u1
- 140.7.0esr-1
- 140.7.0esr-1~deb11u1
- 140.7.0esr-1~deb12u1
- 140.7.0esr-1~deb13u1
- 140.8.0esr-1
- 140.8.0esr-1~deb11u1
- 140.8.0esr-1~deb12u1
- 140.8.0esr-1~deb13u1
- 140.9.0esr-1
- 140.9.0esr-1~deb11u1
- 140.9.0esr-1~deb12u1
- 140.9.0esr-1~deb13u1
- 140.9.1esr-1
- 140.9.1esr-1~deb11u1
- 140.9.1esr-1~deb12u1
- 140.9.1esr-1~deb13u1
- 153.1.0esr-1
- 153.2.0esr-1
No fix published
firefox-esr Debian:13
- Versions
- 128.13.0esr-1
- 128.14.0esr-1
- 128.14.0esr-1~deb11u1
- 128.14.0esr-1~deb12u1
- 128.14.0esr-1~deb13u1
- 140.10.0esr-1
- 140.10.0esr-1~deb11u1
- 140.10.0esr-1~deb12u1
- 140.10.0esr-1~deb13u1
- 140.10.1esr-1
- 140.10.1esr-1~deb11u1
- 140.10.1esr-1~deb12u1
- 140.10.1esr-1~deb13u1
- 140.10.2esr-1
- 140.10.2esr-1~deb11u1
- 140.10.2esr-1~deb12u1
- 140.10.2esr-1~deb13u1
- 140.11.0esr-1
- 140.11.0esr-1~deb11u1
- 140.11.0esr-1~deb12u1
- 140.11.0esr-1~deb13u1
- 140.12.0esr-1
- 140.12.0esr-1~deb11u1
- 140.12.0esr-1~deb12u1
- 140.12.0esr-1~deb13u1
- 140.13.0esr-1
- 140.13.0esr-1~deb11u1
- 140.13.0esr-1~deb12u1
- 140.13.0esr-1~deb13u1
- 140.13.0esr-2
- 140.14.0esr-1~deb11u1
- 140.14.0esr-1~deb12u1
- 140.14.0esr-1~deb13u1
- 140.14.0esr-2
- 140.15.0esr-1
- 140.15.0esr-1~deb12u1
- 140.15.0esr-1~deb13u1
- 140.16.0esr-1
- 140.16.0esr-1~deb12u1
- 140.16.0esr-1~deb13u1
- 140.3.0esr-1
- 140.3.0esr-1~deb11u1
- 140.3.0esr-1~deb11u2
- 140.3.0esr-1~deb12u1
- 140.3.0esr-1~deb13u1
- 140.3.0esr-2
- 140.3.1esr-1
- 140.3.1esr-1~deb11u1
- 140.3.1esr-1~deb12u1
- 140.3.1esr-1~deb13u1
- 140.3.1esr-2
- 140.4.0esr-1
- 140.4.0esr-1~deb11u1
- 140.4.0esr-1~deb12u1
- 140.4.0esr-1~deb13u1
- 140.5.0esr-1
- 140.5.0esr-1~deb11u1
- 140.5.0esr-1~deb12u1
- 140.5.0esr-1~deb13u1
- 140.6.0esr-1
- 140.6.0esr-1~deb11u1
- 140.6.0esr-1~deb12u1
- 140.6.0esr-1~deb13u1
- 140.7.0esr-1
- 140.7.0esr-1~deb11u1
- 140.7.0esr-1~deb12u1
- 140.7.0esr-1~deb13u1
- 140.8.0esr-1
- 140.8.0esr-1~deb11u1
- 140.8.0esr-1~deb12u1
- 140.8.0esr-1~deb13u1
- 140.9.0esr-1
- 140.9.0esr-1~deb11u1
- 140.9.0esr-1~deb12u1
- 140.9.0esr-1~deb13u1
- 140.9.1esr-1
- 140.9.1esr-1~deb11u1
- 140.9.1esr-1~deb12u1
- 140.9.1esr-1~deb13u1
- 153.1.0esr-1
- 153.2.0esr-1
- 153.3.0esr-1
- 153.4.0esr-1
- 153.4.0esr-1~deb12u1
- 153.4.0esr-1~deb13u1
- 153.5.0esr-1
- 153.5.0esr-1~deb12u1
- 153.5.0esr-1~deb13u1
- 153.5.1esr-1
- 153.5.1esr-1~deb12u1
- 153.5.1esr-1~deb13u1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
firefox-esr Debian:14
- Versions
- 128.13.0esr-1
- 128.14.0esr-1
- 128.14.0esr-1~deb11u1
- 128.14.0esr-1~deb12u1
- 128.14.0esr-1~deb13u1
- 140.10.0esr-1
- 140.10.0esr-1~deb11u1
- 140.10.0esr-1~deb12u1
- 140.10.0esr-1~deb13u1
- 140.10.1esr-1
- 140.10.1esr-1~deb11u1
- 140.10.1esr-1~deb12u1
- 140.10.1esr-1~deb13u1
- 140.10.2esr-1
- 140.10.2esr-1~deb11u1
- 140.10.2esr-1~deb12u1
- 140.10.2esr-1~deb13u1
- 140.11.0esr-1
- 140.11.0esr-1~deb11u1
- 140.11.0esr-1~deb12u1
- 140.11.0esr-1~deb13u1
- 140.12.0esr-1
- 140.12.0esr-1~deb11u1
- 140.12.0esr-1~deb12u1
- 140.12.0esr-1~deb13u1
- 140.13.0esr-1
- 140.13.0esr-1~deb11u1
- 140.13.0esr-1~deb12u1
- 140.13.0esr-1~deb13u1
- 140.13.0esr-2
- 140.14.0esr-1~deb11u1
- 140.14.0esr-1~deb12u1
- 140.14.0esr-1~deb13u1
- 140.14.0esr-2
- 140.15.0esr-1
- 140.15.0esr-1~deb12u1
- 140.15.0esr-1~deb13u1
- 140.16.0esr-1
- 140.16.0esr-1~deb12u1
- 140.16.0esr-1~deb13u1
- 140.3.0esr-1
- 140.3.0esr-1~deb11u1
- 140.3.0esr-1~deb11u2
- 140.3.0esr-1~deb12u1
- 140.3.0esr-1~deb13u1
- 140.3.0esr-2
- 140.3.1esr-1
- 140.3.1esr-1~deb11u1
- 140.3.1esr-1~deb12u1
- 140.3.1esr-1~deb13u1
- 140.3.1esr-2
- 140.4.0esr-1
- 140.4.0esr-1~deb11u1
- 140.4.0esr-1~deb12u1
- 140.4.0esr-1~deb13u1
- 140.5.0esr-1
- 140.5.0esr-1~deb11u1
- 140.5.0esr-1~deb12u1
- 140.5.0esr-1~deb13u1
- 140.6.0esr-1
- 140.6.0esr-1~deb11u1
- 140.6.0esr-1~deb12u1
- 140.6.0esr-1~deb13u1
- 140.7.0esr-1
- 140.7.0esr-1~deb11u1
- 140.7.0esr-1~deb12u1
- 140.7.0esr-1~deb13u1
- 140.8.0esr-1
- 140.8.0esr-1~deb11u1
- 140.8.0esr-1~deb12u1
- 140.8.0esr-1~deb13u1
- 140.9.0esr-1
- 140.9.0esr-1~deb11u1
- 140.9.0esr-1~deb12u1
- 140.9.0esr-1~deb13u1
- 140.9.1esr-1
- 140.9.1esr-1~deb11u1
- 140.9.1esr-1~deb12u1
- 140.9.1esr-1~deb13u1
- 153.1.0esr-1
- 153.2.0esr-1
- 153.3.0esr-1
- 153.4.0esr-1
- 153.4.0esr-1~deb12u1
- 153.4.0esr-1~deb13u1
- 153.5.0esr-1
- 153.5.0esr-1~deb12u1
- 153.5.0esr-1~deb13u1
- 153.5.1esr-1
- 153.5.1esr-1~deb12u1
- 153.5.1esr-1~deb13u1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libvpx Debian:12
- Versions
- 1.12.0-1
- Affected ranges
- ECOSYSTEM: < 1.12.0-1+deb12u1
Update to 1.12.0-1+deb12u1
libvpx Debian:13
- Affected ranges
- ECOSYSTEM: < 1.12.0-1.1
Update to 1.12.0-1.1
libvpx Debian:14
- Affected ranges
- ECOSYSTEM: < 1.12.0-1.1
Update to 1.12.0-1.1
thunderbird Debian:12
- Versions
- 1:102.11.0-1
- 1:102.12.0-1
- 1:102.12.0-1~deb10u1
- 1:102.12.0-1~deb11u1
- 1:102.12.0-1~deb12u1
- 1:102.13.0-1
- 1:102.13.0-1~deb10u1
- 1:102.13.0-1~deb11u1
- 1:102.13.0-1~deb12u1
- 1:102.13.1-1
- 1:102.13.1-1~deb10u1
- 1:102.13.1-1~deb11u1
- 1:102.13.1-1~deb12u1
- 1:102.14.0-1~deb10u1
- 1:102.14.0-1~deb11u1
- 1:102.14.0-1~deb12u1
- 1:102.15.0-1~deb10u1
- 1:102.15.0-1~deb11u1
- 1:102.15.0-1~deb12u1
- 1:102.15.1-1~deb10u1
- 1:102.15.1-1~deb11u1
- 1:102.15.1-1~deb12u1
- 1:103.0~b5-1
- 1:104.0~b2-1
- 1:110.0~b4-1
- 1:112.0~b1-1
- 1:113.0~b3-1
- 1:114.0~b2-1
- 1:115.0-1
- 1:115.0.1-1
- 1:115.0.1-2
- 1:115.0~b4-1
- 1:115.0~b6-1
- 1:115.1.0-1
- 1:115.1.1-1
- 1:115.2.0-1
- 1:115.2.2-1
- 1:115.3.0-1
- 1:115.3.0-1~deb12u1
- 1:115.3.1-1~deb10u1
- 1:115.3.1-1~deb11u1
- Affected ranges
- ECOSYSTEM: < 1:115.3.1-1~deb12u1
Update to 1:115.3.1-1~deb12u1
thunderbird Debian:13
- Affected ranges
- ECOSYSTEM: < 1:115.3.1-1
Update to 1:115.3.1-1
thunderbird Debian:14
- Affected ranges
- ECOSYSTEM: < 1:115.3.1-1
Update to 1:115.3.1-1
electron npm
- Affected ranges
- SEMVER: < 22.3.25
Update to 22.3.25
electron npm
- Affected ranges
- SEMVER: ≥ 24.0.0, < 24.8.5
Update to 24.8.5
electron npm
- Affected ranges
- SEMVER: ≥ 25.0.0, < 25.8.4
Update to 25.8.4
electron npm
- Affected ranges
- SEMVER: ≥ 26.0.0, < 26.2.4
Update to 26.2.4
electron npm
- Affected ranges
- SEMVER: ≥ 27.0.0-alpha.1, < 27.0.0-beta.8
Update to 27.0.0-beta.8
libvpx Ubuntu:Pro:14.04:LTS
- Versions
- 1.2.0-2
- 1.3.0-1
- 1.3.0-2
- 1.3.0-2ubuntu0.1~esm1
- 1.3.0-2ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: < 1.3.0-2ubuntu0.1~esm3
Update to 1.3.0-2ubuntu0.1~esm3
libvpx Ubuntu:Pro:16.04:LTS
- Versions
- 1.4.0-4
- 1.5.0-2
- 1.5.0-2ubuntu1
- 1.5.0-2ubuntu1.1
- 1.5.0-2ubuntu1.1+esm1
- Affected ranges
- ECOSYSTEM: < 1.5.0-2ubuntu1.1+esm2
Update to 1.5.0-2ubuntu1.1+esm2
libvpx Ubuntu:Pro:18.04:LTS
- Versions
- 1.6.1-3
- 1.7.0-3
- 1.7.0-3ubuntu0.18.04.1
- Affected ranges
- ECOSYSTEM: < 1.7.0-3ubuntu0.18.04.1+esm1
Update to 1.7.0-3ubuntu0.18.04.1+esm1
mozjs52 Ubuntu:18.04:LTS
- Versions
- 52.3.1-0ubuntu3
- 52.3.1-7fakesync1
- 52.8.1-0ubuntu0.18.04.1
- 52.9.1-0ubuntu0.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs38 Ubuntu:18.04:LTS
- Versions
- 38.8.0~repack1-0ubuntu1
- 38.8.0~repack1-0ubuntu3
- 38.8.0~repack1-0ubuntu4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- https://crbug.com/1486441
- http://www.openwall.com/lists/oss-security/2023/09/28/5
- http://www.openwall.com/lists/oss-security/2023/09/28/6
- http://www.openwall.com/lists/oss-security/2023/09/29/1
- http://www.openwall.com/lists/oss-security/2023/09/29/2
- http://www.openwall.com/lists/oss-security/2023/09/29/7
- http://www.openwall.com/lists/oss-security/2023/09/29/9
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/
- https://security-tracker.debian.org/tracker/CVE-2023-5217
- https://bugzilla.redhat.com/show_bug.cgi?id=2241191
- https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/
- https://www.openwall.com/lists/oss-security/2023/09/28/5
- https://pastebin.com/TdkC4pDv
- https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
- https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282
- https://github.com/webmproject/libvpx/tags
- http://www.openwall.com/lists/oss-security/2023/09/29/11
- http://www.openwall.com/lists/oss-security/2023/09/29/12
- http://www.openwall.com/lists/oss-security/2023/09/29/14
- https://www.debian.org/security/2023/dsa-5510
- https://www.debian.org/security/2023/dsa-5509
- https://www.debian.org/security/2023/dsa-5508
- https://nvd.nist.gov/vuln/detail/CVE-2023-5217