Google · Chromium WebP
CVE-2023-4863
Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
Cos'è
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
CISA: Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.
Cosa fare
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Scadenza per le agenzie federali USA: 4 ottobre 2023
- Aggiunta all'elenco CISA
- 13 settembre 2023
- Pubblicato
- 12 settembre 2023
- Gravità
- Alta 8,8 CVSS 3.1
- Probabilità di attacchi nei prossimi 30 giorni (EPSS)
- >99,9% tra il 0,1% più alto di tutte le vulnerabilità note
- Tipo di debolezza
- CWE-787
- Più dettagli
- NVD · CVE.org · CISA
Tutte le fonti (20)
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
- https://crbug.com/1479274
- https://en.bandisoft.com/honeyview/history/
- https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
- https://security-tracker.debian.org/tracker/CVE-2023-4863
- https://bugzilla.suse.com/show_bug.cgi?id=1215231
- https://news.ycombinator.com/item?id=37478403
- https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/
- https://www.debian.org/security/2023/dsa-5496
- https://www.debian.org/security/2023/dsa-5497
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGK…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTN…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ5…
- https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCA…
- https://www.debian.org/security/2023/dsa-5498
- https://security.gentoo.org/glsa/202309-05
Altre falle sfruttate di Google
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 27 ott 2026 | Unchecked Return Value | Brotli | Critica 9,2 | 55% |
| 16 set 2026 | Improper Authorization | Pixel | Alta 8,8 | 0,6% |
| 9 set 2026 | Out of Bounds Write | Chromium V8 | Alta 8,8 | 3,5% |
| 4 set 2026 | Type Confusion | Chromium V8 | Alta 8,8 | 1,8% |
| 9 giu 2026 | Out-of-Bounds Read and Write | Chromium V8 | Alta 8,8 | 2,4% |
| 1 apr 2026 | Use-After-Free | Dawn | Alta 8,8 | 14% |
| 13 mar 2026 | Out-of-Bounds Write | Skia | Alta 8,8 | 2,3% |
| 13 mar 2026 | Improper Restriction of Operations Within the Bounds of a Memory Buffer | Chromium V8 | Alta 8,8 | 2,7% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.