PT-2023-1010 · Google+11 · Google Chrome+13
Smartkeyss
·
Published
2023-01-23
·
Updated
2026-05-04
·
CVE-2023-4863
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libwebp versions prior to 1.3.2
Google Chrome versions prior to 116.0.5845.187
Mozilla Firefox versions prior to 117.0.1
Mozilla Thunderbird versions prior to 102.15.1 and 115.2.2
Electron versions that bundle libwebp prior to 1.3.2
opencv-python versions prior to 4.8.1.78
opencv-contrib-python versions prior to 4.8.1.78
opencv-contrib-python-headless versions prior to 4.8.1.78
opencv-python-headless versions prior to 4.8.1.78
Description
The vulnerability is a heap buffer overflow in the libwebp library, which can be exploited by a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This can lead to arbitrary code execution or a crash. The vulnerability is caused by a problem with reading beyond the buffer boundaries in memory. Exploitation of the vulnerability allows an attacker to execute code on the system. The vulnerability can be triggered by tricking victims into opening a malicious WebP image.
Recommendations
For libwebp versions prior to 1.3.2, update to version 1.3.2 or later.
For Google Chrome versions prior to 116.0.5845.187, update to version 116.0.5845.187 or later.
For Mozilla Firefox versions prior to 117.0.1, update to version 117.0.1 or later.
For Mozilla Thunderbird versions prior to 102.15.1 and 115.2.2, update to version 102.15.1 or 115.2.2 or later.
For Electron versions that bundle libwebp prior to 1.3.2, update to a version that bundles libwebp 1.3.2 or later.
For opencv-python versions prior to 4.8.1.78, update to version 4.8.1.78 or later.
For opencv-contrib-python versions prior to 4.8.1.78, update to version 4.8.1.78 or later.
For opencv-contrib-python-headless versions prior to 4.8.1.78, update to version 4.8.1.78 or later.
For opencv-python-headless versions prior to 4.8.1.78, update to version 4.8.1.78 or later.
Exploit
Fix
DoS
RCE
Memory Corruption
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Google Chrome
Linuxmint
Firefox
Thunderbird
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Libwebp