CVE-2023-5217

HIGHCISA KEV

8.8

Description

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE Details

CVSS v3.1 Score8.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published9/28/2023

Last Modified10/24/2025

Sourcekev

Honeypot Sightings0

CISA KEV

VendorGoogle

ProductChromium libvpx

Vulnerability NameGoogle Chromium libvpx Heap Buffer Overflow Vulnerability

KEV Date Added2023-10-02

Remediation Due Date2023-10-23

Ransomware UseUnknown

Affected Products

apple:ipadosapple:iphone_osdebian:debian_linuxfedoraproject:fedoragoogle:chromemicrosoft:edgemicrosoft:edge_chromiummozilla:firefoxmozilla:thunderbirdredhat:enterprise_linuxwebmproject:libvpx

Weaknesses (CWE)

CWE-787CWE-787

References

http://seclists.org/fulldisclosure/2023/Oct/12(chrome-cve-admin@google.com)

http://seclists.org/fulldisclosure/2023/Oct/16(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/28/5(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/28/6(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/29/1(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/29/11(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/29/12(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/29/14(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/29/2(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/29/7(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/29/9(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/30/1(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/30/2(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/30/3(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/30/4(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/09/30/5(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/10/01/1(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/10/01/2(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/10/01/5(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/10/02/6(chrome-cve-admin@google.com)

http://www.openwall.com/lists/oss-security/2023/10/03/11(chrome-cve-admin@google.com)

https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/(chrome-cve-admin@google.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2241191(chrome-cve-admin@google.com)

https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html(chrome-cve-admin@google.com)

https://crbug.com/1486441(chrome-cve-admin@google.com)

https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590(chrome-cve-admin@google.com)

https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282(chrome-cve-admin@google.com)

https://github.com/webmproject/libvpx/releases/tag/v1.13.1(chrome-cve-admin@google.com)

https://github.com/webmproject/libvpx/tags(chrome-cve-admin@google.com)

https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html(chrome-cve-admin@google.com)

https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html(chrome-cve-admin@google.com)

https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html(chrome-cve-admin@google.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/(chrome-cve-admin@google.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/(chrome-cve-admin@google.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/(chrome-cve-admin@google.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/(chrome-cve-admin@google.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/(chrome-cve-admin@google.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/(chrome-cve-admin@google.com)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/(chrome-cve-admin@google.com)

https://pastebin.com/TdkC4pDv(chrome-cve-admin@google.com)

https://security-tracker.debian.org/tracker/CVE-2023-5217(chrome-cve-admin@google.com)

https://security.gentoo.org/glsa/202310-04(chrome-cve-admin@google.com)

https://security.gentoo.org/glsa/202401-34(chrome-cve-admin@google.com)

https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/(chrome-cve-admin@google.com)

https://support.apple.com/kb/HT213961(chrome-cve-admin@google.com)

https://support.apple.com/kb/HT213972(chrome-cve-admin@google.com)

https://twitter.com/maddiestone/status/1707163313711497266(chrome-cve-admin@google.com)

https://www.debian.org/security/2023/dsa-5508(chrome-cve-admin@google.com)

https://www.debian.org/security/2023/dsa-5509(chrome-cve-admin@google.com)

https://www.debian.org/security/2023/dsa-5510(chrome-cve-admin@google.com)

https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/(chrome-cve-admin@google.com)

https://www.openwall.com/lists/oss-security/2023/09/28/5(chrome-cve-admin@google.com)

http://seclists.org/fulldisclosure/2023/Oct/12(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2023/Oct/16(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/28/5(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/28/6(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/29/1(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/29/11(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/29/12(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/29/14(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/29/2(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/29/7(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/29/9(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/30/1(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/30/2(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/30/3(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/30/4(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/09/30/5(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/10/01/1(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/10/01/2(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/10/01/5(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/10/02/6(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2023/10/03/11(af854a3a-2127-422b-91ae-364da2661108)

https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.redhat.com/show_bug.cgi?id=2241191(af854a3a-2127-422b-91ae-364da2661108)

https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html(af854a3a-2127-422b-91ae-364da2661108)

https://crbug.com/1486441(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/webmproject/libvpx/releases/tag/v1.13.1(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/webmproject/libvpx/tags(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/(af854a3a-2127-422b-91ae-364da2661108)

https://pastebin.com/TdkC4pDv(af854a3a-2127-422b-91ae-364da2661108)

https://security-tracker.debian.org/tracker/CVE-2023-5217(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202310-04(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202401-34(af854a3a-2127-422b-91ae-364da2661108)

https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/(af854a3a-2127-422b-91ae-364da2661108)

https://support.apple.com/kb/HT213961(af854a3a-2127-422b-91ae-364da2661108)

https://support.apple.com/kb/HT213972(af854a3a-2127-422b-91ae-364da2661108)

https://twitter.com/maddiestone/status/1707163313711497266(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2023/dsa-5508(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2023/dsa-5509(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2023/dsa-5510(af854a3a-2127-422b-91ae-364da2661108)

https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/(af854a3a-2127-422b-91ae-364da2661108)

https://www.openwall.com/lists/oss-security/2023/09/28/5(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5217(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.