CVE-2023-5217
גבוהה 8.8 מנוצלת בשטח (KEV)
ניצול פעיל מאומת — קטלוג CISA KEV
- שם
- Google Chromium libvpx Heap Buffer Overflow Vulnerability
- נוסף לקטלוג
- יעד טיפול (פדרלי)
- פעולה נדרשת
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
תיאור (מקור, אנגלית)
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
מדדים
- CVSS 3.1
-
8.8 (HIGH)
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 49% (אחוזון 100) נכון ל-25/7/2026
- CWE
- CWE-787
מוצרים מושפעים
webmproject: libvpx; microsoft: edge; microsoft: edge chromium; mozilla: firefox; mozilla: thunderbird; fedoraproject: fedora; debian: debian linux; apple: ipados; apple: iphone os; google: chrome; redhat: enterprise linux
קישורים
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-deskto… Vendor Advisory
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-deskto… Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/09/28/5 Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2023/09/28/6 Mailing ListPatchThird Party Advisory
- https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffe… Patch
- https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417… Patch
- http://www.openwall.com/lists/oss-security/2023/09/28/5 Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2023/09/28/6 Mailing ListPatchThird Party Advisory
- https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffe… Patch
- https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417… Patch