Critical libwebp and libvpx flaws reportedly exploited in the wild
Summary
Two media-library flaws, CVE-2023-4863 in libwebp and CVE-2023-5217 in libvpx, are reportedly exploited. The article details affected products and versions, and recommends prioritizing patches for client apps, media-handling servers, and build environments.
Key points
- CVE-2023-4863 affects libwebp versions before 1.3.2; crafted WebP files can trigger an out-of-bounds heap write.
- CVE-2023-5217 affects libvpx versions before 1.13.1; attacker-controlled VP8 media can cause a heap buffer overflow.
- Both flaws were reportedly exploited in the wild, but no concrete details about malicious activity had been published as of October 1, 2023.
- Affected products include browsers and other applications that use the libraries; the article lists Chrome, Firefox, Thunderbird, Edge, Electron, Signal, and Telegram among those affected by CVE-2023-4863.
- Prioritize patching client applications on virtual desktops, server applications that handle images or video, and vulnerable build-environment instances.
- Patching most other vulnerable server instances can be deprioritized, according to the article.
Article Details
- Vulnerability Types
- Heap buffer overflow
- Out-of-bounds heap write
- Severity
- CVE-2023-4863 is critical; CVE-2023-5217 is high severity.
- Affected Versions
- libwebp versions from 0.5.0 before 1.3.2
- libvpx versions before 1.13.1
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2023-4863CVE-2023-4863 is a critical vulnerability in libwebp, and CVE-2023-5217 is a high severity vulnerability in libvpx, both reportedly exploited in the wild.CVE-2023-5217CVE-2023-4863 is a critical vulnerability in libwebp, and CVE-2023-5217 is a high severity vulnerability in libvpx, both reportedly exploited in the wild.
Vendors
Products
Electronapplications. These include other browsers like Firefox as well as Chromium-based components such as Electron, which is utilized in turn by many other popular client-side apps (e.g., Slack, Signal and Telegram).Google ChromeOn September 11th, 2023, a vulnerability was assigned CVE-2023-4863 that reportedly only affected Chrome. More specifically, it was described as a heap buffer overflow in WebP in Chrome, allowing a remote attacker tolibvpxCVE-2023-4863 is a critical vulnerability in libwebp, and CVE-2023-5217 is a high severity vulnerability in libvpx, both reportedly exploited in the wild.libwebpCVE-2023-4863 is a critical vulnerability in libwebp, and CVE-2023-5217 is a high severity vulnerability in libvpx, both reportedly exploited in the wild.Mozilla Firefoxutilized by Chromium and incorporated in many other applications. These include other browsers like Firefox as well as Chromium-based components such as Electron, which is utilized in turn by many other popularSignalsuch as Electron, which is utilized in turn by many other popular client-side apps (e.g., Slack, Signal and Telegram). Additionally, it has been speculated that the same bug was the cause of an iOS and iPadOSTelegramas Electron, which is utilized in turn by many other popular client-side apps (e.g., Slack, Signal and Telegram). Additionally, it has been speculated that the same bug was the cause of an iOS and iPadOS