Veille CVE
CVE-2023-4863
8.8 Élevée Exploitée activementCatalogue CISA KEV — Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
Ajoutée le 13/09/2023 · Échéance de correction (agences US) : 04/10/2023
Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 8.8 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | 8.8 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- http://www.openwall.com/lists/oss-security/2023/09/21/4 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/22/1 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/22/3 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/22/4 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/22/5 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/22/6 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/22/7 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/22/8 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/26/1 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/26/7 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/28/1 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/28/2 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/28/4 Mailing List
- https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/ Third Party Advisory
- https://blog.isosceles.com/the-webp-0day/ ExploitThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1215231 Issue TrackingThird Party Advisory
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html Vendor Advisory
- https://crbug.com/1479274 Issue TrackingVendor Advisory
- https://en.bandisoft.com/honeyview/history/ Release Notes
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a Patch
- https://github.com/webmproject/libwebp/releases/tag/v1.3.2 Release Notes
- https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html Mailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html Mailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html Mailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ Mailing List
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863 PatchThird Party Advisory
- https://news.ycombinator.com/item?id=37478403 ExploitThird Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2023-4863 Issue TrackingThird Party Advisory
- https://security.gentoo.org/glsa/202309-05 Third Party Advisory
- https://security.gentoo.org/glsa/202401-10 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230929-0011/ Third Party Advisory
- https://sethmlarson.dev/security-developer-in-residence-weekly-report-16 Exploit
- https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/ ExploitThird Party Advisory
- https://www.bentley.com/advisories/be-2023-0001/ Third Party Advisory
- https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/ Third Party Advisory
- https://www.debian.org/security/2023/dsa-5496 Mailing List
- https://www.debian.org/security/2023/dsa-5497 Mailing List
- https://www.debian.org/security/2023/dsa-5498 Mailing ListThird Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/ Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/09/21/4 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/22/1 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/22/3 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/22/4 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/22/5 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/22/6 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/22/7 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/22/8 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/26/1 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/26/7 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/28/1 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/28/2 Mailing List
- http://www.openwall.com/lists/oss-security/2023/09/28/4 Mailing List
- https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/ Third Party Advisory
- https://blog.isosceles.com/the-webp-0day/ ExploitThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1215231 Issue TrackingThird Party Advisory
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html Vendor Advisory
- https://crbug.com/1479274 Issue TrackingVendor Advisory
- https://en.bandisoft.com/honeyview/history/ Release Notes
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a Patch
- https://github.com/webmproject/libwebp/releases/tag/v1.3.2 Release Notes
- https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html Mailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html Mailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html Mailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ Mailing List
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863 PatchThird Party Advisory
- https://news.ycombinator.com/item?id=37478403 ExploitThird Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2023-4863 Issue TrackingThird Party Advisory
- https://security.gentoo.org/glsa/202309-05 Third Party Advisory
- https://security.gentoo.org/glsa/202401-10 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230929-0011/ Third Party Advisory
- https://sethmlarson.dev/security-developer-in-residence-weekly-report-16 Exploit
- https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/ ExploitThird Party Advisory
- https://www.bentley.com/advisories/be-2023-0001/ Third Party Advisory
- https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/ Third Party Advisory
- https://www.debian.org/security/2023/dsa-5496 Mailing List
- https://www.debian.org/security/2023/dsa-5497 Mailing List
- https://www.debian.org/security/2023/dsa-5498 Mailing ListThird Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/ Third Party Advisory
- https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863 ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4863 US Government Resource