CVE-2023-5217
published 2023-09-28CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap…
high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2023-10-23
Exploited in the wild
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Affected
56 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_16.7.1_and_ipados | — | — |
| apple | ios_17.0.3_and_ipados | — | — |
| apple | ipados | — | — |
| apple | ipados | >= 17.0 < 17.0.3 | 17.0.3 |
| apple | iphone_os | — | — |
| apple | iphone_os | >= 17.0 < 17.0.3 | 17.0.3 |
| chromium | chromium | >= 0 < 117.0.5938.132-1~deb11u1 | 117.0.5938.132-1~deb11u1 |
| chromium | chromium | >= 0 < 117.0.5938.132-1~deb12u1 | 117.0.5938.132-1~deb12u1 |
| chromium | chromium | >= 0 < 117.0.5938.132-1 | 117.0.5938.132-1 |
| chromium | chromium | >= 0 < 117.0.5938.132-1 | 117.0.5938.132-1 |
| debian | chromium | < chromium 117.0.5938.132-1~deb12u1 (bookworm) | chromium 117.0.5938.132-1~deb12u1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | firefox | < chromium 117.0.5938.132-1~deb12u1 (bookworm) | chromium 117.0.5938.132-1~deb12u1 (bookworm) |
| debian | firefox-esr | < chromium 117.0.5938.132-1~deb12u1 (bookworm) | chromium 117.0.5938.132-1~deb12u1 (bookworm) |
| debian | libvpx | < chromium 117.0.5938.132-1~deb12u1 (bookworm) | chromium 117.0.5938.132-1~deb12u1 (bookworm) |
| debian | thunderbird | < chromium 117.0.5938.132-1~deb12u1 (bookworm) | chromium 117.0.5938.132-1~deb12u1 (bookworm) |
| electron | electron | >= 0 < 22.3.25 | 22.3.25 |
| electron | electron | >= 24.0.0 < 24.8.5 | 24.8.5 |
| electron | electron | >= 25.0.0 < 25.8.4 | 25.8.4 |
| electron | electron | >= 26.0.0 < 26.2.4 | 26.2.4 |
| electron | electron | >= 27.0.0-alpha.1 < 27.0.0-beta.8 | 27.0.0-beta.8 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ghsa8.8HIGH
osv8.8HIGH
vulncheck8.8HIGH
cisa8.8HIGH