CVE-2023-4863

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-4863
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2023/09/21/4 Mailing List
http://www.openwall.com/lists/oss-security/2023/09/22/1 Mailing List
http://www.openwall.com/lists/oss-security/2023/09/22/3 Mailing List
http://www.openwall.com/lists/oss-security/2023/09/22/4 Mailing List
http://www.openwall.com/lists/oss-security/2023/09/22/5 Mailing List
http://www.openwall.com/lists/oss-security/2023/09/22/6 Mailing List
http://www.openwall.com/lists/oss-security/2023/09/22/7 Mailing List
http://www.openwall.com/lists/oss-security/2023/09/22/8 Mailing List
http://www.openwall.com/lists/oss-security/2023/09/26/1 Mailing List
http://www.openwall.com/lists/oss-security/2023/09/26/7 Mailing List
http://www.openwall.com/lists/oss-security/2023/09/28/1 Mailing List
http://www.openwall.com/lists/oss-security/2023/09/28/2 Mailing List
http://www.openwall.com/lists/oss-security/2023/09/28/4 Mailing List
https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/ Third Party Advisory
https://blog.isosceles.com/the-webp-0day/ Exploit Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1215231 Issue Tracking Third Party Advisory
https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html Release Notes Vendor Advisory
https://crbug.com/1479274 Issue Tracking Permissions Required Vendor Advisory
https://en.bandisoft.com/honeyview/history/ Release Notes Third Party Advisory
https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a Patch
https://github.com/webmproject/libwebp/releases/tag/v1.3.2 Release Notes
https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/ Mailing List Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ Mailing List Release Notes
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863 Patch Vendor Advisory
https://news.ycombinator.com/item?id=37478403 Exploit Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2023-4863 Issue Tracking Third Party Advisory
https://security.gentoo.org/glsa/202309-05 Third Party Advisory
https://security.gentoo.org/glsa/202401-10 Third Party Advisory
https://security.netapp.com/advisory/ntap-20230929-0011/ Third Party Advisory
https://sethmlarson.dev/security-developer-in-residence-weekly-report-16 Exploit
https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/ Exploit Third Party Advisory
https://www.bentley.com/advisories/be-2023-0001/ Third Party Advisory
https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/ Third Party Advisory
https://www.debian.org/security/2023/dsa-5496 Third Party Advisory
https://www.debian.org/security/2023/dsa-5497 Third Party Advisory
https://www.debian.org/security/2023/dsa-5498 Third Party Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:teams:1.6.00.26463:*:*:*:*:macos:*:*
cpe:2.3:a:microsoft:teams:1.6.00.26474:*:*:*:*:desktop:*:*
cpe:2.3:a:microsoft:webp_image_extension:1.0.62681.0:*:*:*:*:*:*:*

Configuration 6 (hide)

cpe:2.3:a:webmproject:libwebp:*:*:*:*:*:*:*:*

Configuration 7 (hide)

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*

Configuration 8 (hide)

cpe:2.3:a:bentley:seequent_leapfrog:*:*:*:*:*:*:*:*
History

31 Jul 2024, 18:19

Type Values Removed Values Added
First Time Microsoft webp Image Extension
Microsoft teams
Microsoft edge Chromium
CPE cpe:2.3:a:microsoft:webp_image_extension:1.0.62681.0:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:teams:1.6.00.26474:*:*:*:*:desktop:*:*
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:teams:1.6.00.26463:*:*:*:*:macos:*:*

27 Jun 2024, 18:36

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2023/09/21/4 - () http://www.openwall.com/lists/oss-security/2023/09/21/4 - Mailing List
References () http://www.openwall.com/lists/oss-security/2023/09/22/1 - () http://www.openwall.com/lists/oss-security/2023/09/22/1 - Mailing List
References () http://www.openwall.com/lists/oss-security/2023/09/22/3 - () http://www.openwall.com/lists/oss-security/2023/09/22/3 - Mailing List
References () http://www.openwall.com/lists/oss-security/2023/09/22/4 - () http://www.openwall.com/lists/oss-security/2023/09/22/4 - Mailing List
References () http://www.openwall.com/lists/oss-security/2023/09/22/5 - () http://www.openwall.com/lists/oss-security/2023/09/22/5 - Mailing List
References () http://www.openwall.com/lists/oss-security/2023/09/22/6 - () http://www.openwall.com/lists/oss-security/2023/09/22/6 - Mailing List
References () http://www.openwall.com/lists/oss-security/2023/09/22/7 - () http://www.openwall.com/lists/oss-security/2023/09/22/7 - Mailing List
References () http://www.openwall.com/lists/oss-security/2023/09/22/8 - () http://www.openwall.com/lists/oss-security/2023/09/22/8 - Mailing List
References () http://www.openwall.com/lists/oss-security/2023/09/26/1 - () http://www.openwall.com/lists/oss-security/2023/09/26/1 - Mailing List
References () http://www.openwall.com/lists/oss-security/2023/09/26/7 - () http://www.openwall.com/lists/oss-security/2023/09/26/7 - Mailing List
References () http://www.openwall.com/lists/oss-security/2023/09/28/1 - () http://www.openwall.com/lists/oss-security/2023/09/28/1 - Mailing List
References () http://www.openwall.com/lists/oss-security/2023/09/28/2 - () http://www.openwall.com/lists/oss-security/2023/09/28/2 - Mailing List
References () http://www.openwall.com/lists/oss-security/2023/09/28/4 - () http://www.openwall.com/lists/oss-security/2023/09/28/4 - Mailing List
References () https://blog.isosceles.com/the-webp-0day/ - () https://blog.isosceles.com/the-webp-0day/ - Exploit, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/ - Mailing List, Release Notes
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ - Mailing List, Release Notes
References () https://security.gentoo.org/glsa/202401-10 - () https://security.gentoo.org/glsa/202401-10 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20230929-0011/ - () https://security.netapp.com/advisory/ntap-20230929-0011/ - Third Party Advisory
References () https://sethmlarson.dev/security-developer-in-residence-weekly-report-16 - () https://sethmlarson.dev/security-developer-in-residence-weekly-report-16 - Exploit
References () https://www.bentley.com/advisories/be-2023-0001/ - () https://www.bentley.com/advisories/be-2023-0001/ - Third Party Advisory
CPE cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:bentley:seequent_leapfrog:*:*:*:*:*:*:*:*
First Time Netapp
Bentley
Bentley seequent Leapfrog
Netapp active Iq Unified Manager

07 Jan 2024, 11:15

Type Values Removed Values Added
References
  • () https://security.gentoo.org/glsa/202401-10 -

28 Oct 2023, 19:15

Type Values Removed Values Added
References
  • (MISC) https://www.bentley.com/advisories/be-2023-0001/ -

27 Oct 2023, 18:15

Type Values Removed Values Added
References
  • (MISC) https://sethmlarson.dev/security-developer-in-residence-weekly-report-16 -

02 Oct 2023, 02:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ -

29 Sep 2023, 22:15

Type Values Removed Values Added
References
  • (MISC) https://security.netapp.com/advisory/ntap-20230929-0011/ -

28 Sep 2023, 18:15

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/09/28/4 -

28 Sep 2023, 15:15

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/09/28/2 -

28 Sep 2023, 12:15

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/09/28/1 -

27 Sep 2023, 20:15

Type Values Removed Values Added
Summary Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/09/26/7 -

27 Sep 2023, 15:19

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/09/26/1 -

22 Sep 2023, 18:15

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/09/22/7 -
  • (MISC) http://www.openwall.com/lists/oss-security/2023/09/22/6 -
  • (MISC) http://www.openwall.com/lists/oss-security/2023/09/22/8 -

22 Sep 2023, 15:15

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/09/22/3 -
  • (MISC) http://www.openwall.com/lists/oss-security/2023/09/22/4 -
  • (MISC) http://www.openwall.com/lists/oss-security/2023/09/22/5 -

22 Sep 2023, 09:15

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/09/22/1 -

22 Sep 2023, 04:15

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/09/21/4 -
  • (MISC) https://blog.isosceles.com/the-webp-0day/ -

21 Sep 2023, 03:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/ -

19 Sep 2023, 17:49

Type Values Removed Values Added
CPE cpe:2.3:a:webmproject:libwebp:*:*:*:*:*:*:*:*
First Time Webmproject
Webmproject libwebp

18 Sep 2023, 17:48

Type Values Removed Values Added
CWE CWE-787
First Time Microsoft
Debian debian Linux
Microsoft edge
Debian
Mozilla firefox Esr
Google chrome
Fedoraproject
Fedoraproject fedora
Mozilla thunderbird
Mozilla firefox
Google
Mozilla
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
References
  • (MISC) https://www.debian.org/security/2023/dsa-5497 - Third Party Advisory
  • (MISC) https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html - Mailing List, Third Party Advisory
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/ - Mailing List, Third Party Advisory
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/ - Mailing List, Third Party Advisory
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/ - Mailing List, Third Party Advisory
  • (MISC) https://github.com/webmproject/libwebp/releases/tag/v1.3.2 - Release Notes
  • (MISC) https://security.gentoo.org/glsa/202309-05 - Third Party Advisory
  • (MISC) https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html - Mailing List, Third Party Advisory
  • (MISC) https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html - Mailing List, Third Party Advisory
  • (MISC) https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/ - Third Party Advisory
  • (MISC) https://www.debian.org/security/2023/dsa-5498 - Third Party Advisory
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/ - Mailing List, Third Party Advisory
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/ - Mailing List, Third Party Advisory
  • (MISC) https://www.debian.org/security/2023/dsa-5496 - Third Party Advisory
References (MISC) https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html - (MISC) https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html - Release Notes, Vendor Advisory
References (MISC) https://bugzilla.suse.com/show_bug.cgi?id=1215231 - (MISC) https://bugzilla.suse.com/show_bug.cgi?id=1215231 - Issue Tracking, Third Party Advisory
References (MISC) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863 - (MISC) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863 - Patch, Vendor Advisory
References (MISC) https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/ - (MISC) https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/ - Third Party Advisory
References (MISC) https://crbug.com/1479274 - (MISC) https://crbug.com/1479274 - Issue Tracking, Permissions Required, Vendor Advisory
References (MISC) https://en.bandisoft.com/honeyview/history/ - (MISC) https://en.bandisoft.com/honeyview/history/ - Release Notes, Third Party Advisory
References (MISC) https://news.ycombinator.com/item?id=37478403 - (MISC) https://news.ycombinator.com/item?id=37478403 - Exploit, Third Party Advisory
References (MISC) https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/ - (MISC) https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/ - Exploit, Third Party Advisory
References (MISC) https://security-tracker.debian.org/tracker/CVE-2023-4863 - (MISC) https://security-tracker.debian.org/tracker/CVE-2023-4863 - Issue Tracking, Third Party Advisory
References (MISC) https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/ - (MISC) https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/ - Third Party Advisory
References (MISC) https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a - (MISC) https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a - Patch

13 Sep 2023, 17:15

Type Values Removed Values Added
References
  • (MISC) https://bugzilla.suse.com/show_bug.cgi?id=1215231 -
  • (MISC) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863 -
  • (MISC) https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/ -
  • (MISC) https://en.bandisoft.com/honeyview/history/ -
  • (MISC) https://news.ycombinator.com/item?id=37478403 -
  • (MISC) https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/ -
  • (MISC) https://security-tracker.debian.org/tracker/CVE-2023-4863 -
  • (MISC) https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/ -
  • (MISC) https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a -

12 Sep 2023, 19:38

Type Values Removed Values Added
New CVE
Information

Published : 2023-09-12 15:15

Updated : 2024-07-31 18:19

NVD link : CVE-2023-4863

Mitre link : CVE-2023-4863

CVE.ORG link : CVE-2023-4863

JSON object : View

Products Affected

mozilla

  • firefox_esr
  • thunderbird
  • firefox

webmproject

  • libwebp

netapp

  • active_iq_unified_manager

debian

  • debian_linux

google

  • chrome

microsoft

  • edge_chromium
  • webp_image_extension
  • edge
  • teams

fedoraproject

  • fedora

bentley

  • seequent_leapfrog
CWE
CWE-787

Out-of-bounds Write


NetmanageIT Website NetmanageIT OSINT Web NetmanageIT OpenCTI NetmanageIT PDF Tools NetmanageIT CTO Corner Blog NetmanageIT Email Header Analyzer NetmanageIT Password Pusher NetmanageIT Internet Health and Latency Dashboard NetmanageIT Dedicated Speed Test Site NetmanageIT Ubuntu Mirror 10Gbps Copyright OpenCVE 2024