Overview
- Description
- Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Source
- chrome-cve-admin@google.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity
- HIGH
Known exploits
Data from CISA
- Vulnerability name
- Google Chromium libvpx Heap Buffer Overflow Vulnerability
- Exploit added on
- Oct 2, 2023
- Exploit action due
- Oct 23, 2023
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Weaknesses
- nvd@nist.gov
- CWE-787
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8F840D02-4766-4644-8FD6-637E945E88FB",
"versionEndExcluding": "117.0.5938.132"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B8EE027E-A8D8-4038-B0C5-3F9ABA3079B6",
"versionEndExcluding": "118.0.1"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:*",
"vulnerable": false,
"matchCriteriaId": "C0246068-275F-4D13-93B9-44AD91D2EFFB",
"versionEndExcluding": "118.1"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2AAF4C02-0ED7-4AEF-BB14-A0A48DAC3B2E",
"versionEndExcluding": "115.3.1"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:android:*:*",
"vulnerable": false,
"matchCriteriaId": "54F53CD4-5766-401B-8333-1B8937112AD0",
"versionEndExcluding": "118.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:webmproject:libvpx:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "385F58CC-4AA0-4C41-9394-C9481586689E",
"versionEndExcluding": "1.13.1"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge:116.0.1938.98:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "83749E8D-D4EC-4C5E-B031-8DD4C5C3AA72"
},
{
"criteria": "cpe:2.3:a:microsoft:edge:117.0.2045.47:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39F5AB10-A20E-4B12-863D-9335A6344130"
},
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:116.0.5845.229:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "494B17DA-B40E-4B79-925D-2F439C7A4BCC"
},
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:117.0.5938.132:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0A1735C0-78BF-4B9C-9EC6-64471C609046"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8EE027E-A8D8-4038-B0C5-3F9ABA3079B6",
"versionEndExcluding": "118.0.1"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:*",
"vulnerable": true,
"matchCriteriaId": "C0246068-275F-4D13-93B9-44AD91D2EFFB",
"versionEndExcluding": "118.1"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2AAF4C02-0ED7-4AEF-BB14-A0A48DAC3B2E",
"versionEndExcluding": "115.3.1"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:android:*:*",
"vulnerable": true,
"matchCriteriaId": "54F53CD4-5766-401B-8333-1B8937112AD0",
"versionEndExcluding": "118.1"
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C287FD41-1668-4BA8-9BF5-7C56420F6F38",
"versionEndExcluding": "115.3.1"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D"
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9"
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD22C5B0-7113-4F66-AF85-46F9DD0DC6B3",
"versionEndExcluding": "17.0.3",
"versionStartIncluding": "17.0"
},
{
"criteria": "cpe:2.3:o:apple:ipad_os:16.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7DE4E0B0-9E6E-4735-8EFC-81D1F1724FCF"
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F1D28032-F9E6-45E7-98B6-7CE2351C4C99",
"versionEndExcluding": "17.0.3",
"versionStartIncluding": "17.0"
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:16.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF582B55-1D2F-4F53-9F3D-DB52F211B600"
}
],
"operator": "OR"
}
]
}
]