CVE-2023-5217

Google Chromium libvpx Heap Buffer Overflow

8.8 HIGHActively exploited (CISA KEV)Public exploitEPSS 49.0%

Published28 Sept 2023
Added to CISA KEV2 Oct 2023
Remediation due23 Oct 2023

Description

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Google Chrome< 117.0.5938.132

Microsoft Edge116.0.1938.98 · 117.0.2045.47

Microsoft Edge Chromium116.0.5845.229 · 117.0.5938.132

Mozilla Firefox< 118.0.1 · < 118.1 · < 115.3.1

Mozilla Thunderbird< 115.3.1

Webmproject Libvpx< 1.13.1

Apple iPadOS≥ 17.0 < 17.0.3 · 16.7

Apple iPhone OS≥ 17.0 < 17.0.3 · 16.7

Debian Linux10.0 · 11.0 · 12.0

Fedoraproject Fedora37 · 38 · 39

Redhat Enterprise Linux9.0

Remediation

Fixed in

Google Chrome≥ 117.0.5938.132

Mozilla Firefox≥ 118.0.1

Mozilla Thunderbird≥ 115.3.1

Webmproject Libvpx≥ 1.13.1

Apple iPadOS≥ 17.0.3

Apple iPhone OS≥ 17.0.3

Patch & vendor advisories

References

https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2241191Issue TrackingThird Party Advisory
https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.htmlVendor Advisory
https://crbug.com/1486441ExploitIssue Tracking
http://seclists.org/fulldisclosure/2023/Oct/12Mailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/16Mailing ListThird Party Advisory
https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590Patch
https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282Patch
https://github.com/webmproject/libvpx/releases/tag/v1.13.1Release Notes
https://github.com/webmproject/libvpx/tagsProduct

and 43 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2023-5217 being actively exploited?

Yes. CVE-2023-5217 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2 Oct 2023.

How severe is CVE-2023-5217?

CVE-2023-5217 has a CVSS 3.1 base score of 8.8, rated high. EPSS estimates a 49.0% probability of exploitation.

Which products are affected by CVE-2023-5217?

Affected products include Google Chrome, Microsoft Edge, Microsoft Edge Chromium, Mozilla Firefox, Mozilla Thunderbird, and 6 more.

How do I fix CVE-2023-5217?

Upgrade affected software to a fixed version, for example Google Chrome 117.0.5938.132, Mozilla Firefox 118.0.1, Mozilla Thunderbird 115.3.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-5217 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.