CVE-2023-5217

Published: Sep 28, 2023Modified: Jun 17, 2026CISA KEV

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Affected (21)

Products: Webmproject: Libvpx · Microsoft: Edge, Edge Chromium · Mozilla: Firefox, Thunderbird · +5 more

Show all products

Webmproject: Libvpx · Microsoft: Edge, Edge Chromium · Mozilla: Firefox, Thunderbird · Fedoraproject: Fedora · Debian: Debian Linux · Apple: Ipados, Iphone Os · Google: Chrome · Redhat: Enterprise Linux

1 product

2 products

2 products

1 product

1 product

2 products

1 product

1 product

Enterprise Linux

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Webmproject Libvpx	Before 1.13.1

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Microsoft Edge	Version 116.0.1938.98
Microsoft Edge	Version 117.0.2045.47
Microsoft Edge Chromium	Version 116.0.5845.229
Microsoft Edge Chromium	Version 117.0.5938.132

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Before 118.1
Mozilla Firefox	Before 118.0.1
Mozilla Firefox	Before 115.3.1
Mozilla Thunderbird	Before 115.3.1

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 37
Fedoraproject Fedora	Version 38
Fedoraproject Fedora	Version 39

Configuration E

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0
Debian Debian Linux	Version 12.0

Configuration F

4 vulnerable

Vulnerable Software	Affected Versions
Apple Ipados	From 17.0 to 17.0.3
Apple Ipados	Version 16.7
Apple Iphone Os	From 17.0 to 17.0.3
Apple Iphone Os	Version 16.7

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Google Chrome	Before 117.0.5938.132

Configuration H

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 9.0

Related CWEs

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (105)

http://seclists.org/fulldisclosure/2023/Oct/12

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2023/Oct/16

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/28/5

Source: chrome-cve-admin@google.com

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/28/6

Source: chrome-cve-admin@google.com

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/29/1

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/29/11

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/29/12

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/29/14

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/29/2

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/29/7

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/29/9

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/30/1

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/30/2

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/30/3

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/30/4

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/30/5

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/01/1

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/01/2

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/01/5

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/02/6

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/03/11

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/

Source: chrome-cve-admin@google.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2241191

Source: chrome-cve-admin@google.com

Issue TrackingThird Party Advisory

https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html

Source: chrome-cve-admin@google.com

Vendor Advisory

https://crbug.com/1486441

Source: chrome-cve-admin@google.com

ExploitIssue Tracking

https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590

Source: chrome-cve-admin@google.com

Patch

https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282

Source: chrome-cve-admin@google.com

Patch

https://github.com/webmproject/libvpx/releases/tag/v1.13.1

Source: chrome-cve-admin@google.com

Release Notes

https://github.com/webmproject/libvpx/tags

Source: chrome-cve-admin@google.com

Product

https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html

Source: chrome-cve-admin@google.com

Mailing List

https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html

Source: chrome-cve-admin@google.com

Mailing List

https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html

Source: chrome-cve-admin@google.com

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/

Source: chrome-cve-admin@google.com

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/

Source: chrome-cve-admin@google.com

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/

Source: chrome-cve-admin@google.com

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/

Source: chrome-cve-admin@google.com

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/

Source: chrome-cve-admin@google.com

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/

Source: chrome-cve-admin@google.com

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/

Source: chrome-cve-admin@google.com

Mailing List

https://pastebin.com/TdkC4pDv

Source: chrome-cve-admin@google.com

Not Applicable

https://security-tracker.debian.org/tracker/CVE-2023-5217

Source: chrome-cve-admin@google.com

Third Party Advisory

https://security.gentoo.org/glsa/202310-04

Source: chrome-cve-admin@google.com

Third Party Advisory

https://security.gentoo.org/glsa/202401-34

Source: chrome-cve-admin@google.com

Third Party Advisory

https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/

Source: chrome-cve-admin@google.com

Third Party Advisory

https://support.apple.com/kb/HT213961

Source: chrome-cve-admin@google.com

Third Party Advisory

https://support.apple.com/kb/HT213972

Source: chrome-cve-admin@google.com

Third Party Advisory

https://twitter.com/maddiestone/status/1707163313711497266

Source: chrome-cve-admin@google.com

Third Party Advisory

https://www.debian.org/security/2023/dsa-5508

Source: chrome-cve-admin@google.com

Mailing List

https://www.debian.org/security/2023/dsa-5509

Source: chrome-cve-admin@google.com

Mailing List

https://www.debian.org/security/2023/dsa-5510

Source: chrome-cve-admin@google.com

Mailing List

https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/

Source: chrome-cve-admin@google.com

Third Party Advisory

https://www.openwall.com/lists/oss-security/2023/09/28/5

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2023/Oct/12

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2023/Oct/16

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/28/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/28/6

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/29/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/29/11

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/29/12

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/29/14

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/29/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/29/7

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/29/9

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/30/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/30/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/30/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/30/4

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/30/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/01/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/01/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/01/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/02/6

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/03/11

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2241191

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://crbug.com/1486441

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue Tracking

https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/webmproject/libvpx/releases/tag/v1.13.1

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://github.com/webmproject/libvpx/tags

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://pastebin.com/TdkC4pDv

Source: af854a3a-2127-422b-91ae-364da2661108

Not Applicable

https://security-tracker.debian.org/tracker/CVE-2023-5217

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.gentoo.org/glsa/202310-04

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.gentoo.org/glsa/202401-34

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.apple.com/kb/HT213961

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.apple.com/kb/HT213972

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://twitter.com/maddiestone/status/1707163313711497266

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2023/dsa-5508

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://www.debian.org/security/2023/dsa-5509

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://www.debian.org/security/2023/dsa-5510

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.openwall.com/lists/oss-security/2023/09/28/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5217

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.