Out-of-bounds write in Google Chrome
Priority CRITICAL 97Exploited in the wildCWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 21 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-787 and the CVSS impact.
Summary
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Why it matters now
Exploitation Active In CISA KEV since 2023-10-02CISA due date 2023-10-23
EPSS 0.49013 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Chrome (Google): 117.0.5938.132libvpx (Google): 1.13.1+1 more productRed Hat: 23 advisoriesRed Hat: 21 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Chrome | 117.0.5938.132 to before 117.0.5938.132 | 117.0.5938.132 | Patch available | CNA | |
| libvpx | 1.13.1 to before 1.13.1 | 1.13.1 | Patch available | CNA | |
| — | electron (npm) | before 22.3.25 | 22.3.25 | Patch available | GHSA-qqvq-6xgj-jw8g |
| — | electron (npm) | 24.0.0 to before 24.8.5 | 24.8.5 | Patch available | GHSA-qqvq-6xgj-jw8g |
| — | electron (npm) | 25.0.0 to before 25.8.4 | 25.8.4 | Patch available | GHSA-qqvq-6xgj-jw8g |
| — | electron (npm) | 26.0.0 to before 26.2.4 | 26.2.4 | Patch available | GHSA-qqvq-6xgj-jw8g |
| — | electron (npm) | 27.0.0-alpha.1 to before 27.0.0-beta.8 | 27.0.0-beta.8 | Patch available | GHSA-qqvq-6xgj-jw8g |
- Chrome VendorGoogle Affected 117.0.5938.132 to before 117.0.5938.132 Fixed in 117.0.5938.132 Patch available CNA
- libvpx VendorGoogle Affected 1.13.1 to before 1.13.1 Fixed in 1.13.1 Patch available CNA
- electron (npm) Vendor— Affected before 22.3.25 Fixed in 22.3.25 Patch available GHSA-qqvq-6xgj-jw8g
- electron (npm) Vendor— Affected 24.0.0 to before 24.8.5 Fixed in 24.8.5 Patch available GHSA-qqvq-6xgj-jw8g
- electron (npm) Vendor— Affected 25.0.0 to before 25.8.4 Fixed in 25.8.4 Patch available GHSA-qqvq-6xgj-jw8g
- electron (npm) Vendor— Affected 26.0.0 to before 26.2.4 Fixed in 26.2.4 Patch available GHSA-qqvq-6xgj-jw8g
- electron (npm) Vendor— Affected 27.0.0-alpha.1 to before 27.0.0-beta.8 Fixed in 27.0.0-beta.8 Patch available GHSA-qqvq-6xgj-jw8g
CPE configurations NVD · 21
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:webmproject:libvpx:*:*:*:*:*:*:*:* | before 1.13.1 | Vulnerable | Webmproject |
| cpe:2.3:a:microsoft:edge:116.0.1938.98:*:*:*:*:*:*:* | 116.0.1938.98 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:edge:117.0.2045.47:*:*:*:*:*:*:* | 117.0.2045.47 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:edge_chromium:116.0.5845.229:*:*:*:*:*:*:* | 116.0.5845.229 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:edge_chromium:117.0.5938.132:*:*:*:*:*:*:* | 117.0.5938.132 | Vulnerable | Microsoft |
| cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* | before 115.3.1 | Vulnerable | Mozilla |
| cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* | before 118.0.1 | Vulnerable | Mozilla |
| cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:* | before 118.1 | Vulnerable | Mozilla |
| cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* | before 115.3.1 | Vulnerable | Mozilla |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
- cpe:2.3:a:webmproject:libvpx:*:*:*:*:*:*:*:* Versions before 1.13.1 Vulnerable ·Webmproject
- cpe:2.3:a:microsoft:edge:116.0.1938.98:*:*:*:*:*:*:* Versions 116.0.1938.98 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:edge:117.0.2045.47:*:*:*:*:*:*:* Versions 117.0.2045.47 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:edge_chromium:116.0.5845.229:*:*:*:*:*:*:* Versions 116.0.5845.229 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:edge_chromium:117.0.5938.132:*:*:*:*:*:*:* Versions 117.0.5938.132 Vulnerable ·Microsoft
- cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* Versions before 115.3.1 Vulnerable ·Mozilla
- cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* Versions before 118.0.1 Vulnerable ·Mozilla
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:* Versions before 118.1 Vulnerable ·Mozilla
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* Versions before 115.3.1 Vulnerable ·Mozilla
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
Show 11 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* | 12.0 | Vulnerable | Debian |
| cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* | 17.0 to before 17.0.3 | Vulnerable | Apple |
| cpe:2.3:o:apple:ipados:16.7:*:*:*:*:*:*:* | 16.7 | Vulnerable | Apple |
| cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | 17.0 to before 17.0.3 | Vulnerable | Apple |
| cpe:2.3:o:apple:iphone_os:16.7:*:*:*:*:*:*:* | 16.7 | Vulnerable | Apple |
| cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | before 117.0.5938.132 | Vulnerable | |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* Versions 17.0 to before 17.0.3 Vulnerable ·Apple
- cpe:2.3:o:apple:ipados:16.7:*:*:*:*:*:*:* Versions 16.7 Vulnerable ·Apple
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* Versions 17.0 to before 17.0.3 Vulnerable ·Apple
- cpe:2.3:o:apple:iphone_os:16.7:*:*:*:*:*:*:* Versions 16.7 Vulnerable ·Apple
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* Versions before 117.0.5938.132 Vulnerable ·Google
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
Remediation
- Fix · CNA Chrome (Google) Fixed in 117.0.5938.132
- Fix · CNA libvpx (Google) Fixed in 1.13.1
- Fix · GHSA-qqvq-6xgj-jw8g electron (npm) Fixed in 22.3.25 Advisory →
- Fix · GHSA-qqvq-6xgj-jw8g electron (npm) Fixed in 24.8.5 Advisory →
- Fix · GHSA-qqvq-6xgj-jw8g electron (npm) Fixed in 25.8.4 Advisory →
- Fix · GHSA-qqvq-6xgj-jw8g electron (npm) Fixed in 26.2.4 Advisory →
- Fix · GHSA-qqvq-6xgj-jw8g electron (npm) Fixed in 27.0.0-beta.8 Advisory →
Red Hat 23 advisories
- RHSA-2023:5538 Released 2023-10-09 · Red Hat rating Importantlibvpx security update
- Red Hat CodeReady Linux Builder EUS (v.8.6) libvpx-devel-1.7.0-10.el8_6
- Red Hat Enterprise Linux AppStream EUS (v.8.6) libvpx-1.7.0-10.el8_6
- RHSA-2023:5534 Released 2023-10-09 · Red Hat rating Importantlibvpx security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) libvpx-1.7.0-8.el8_2
- Red Hat Enterprise Linux AppStream E4S (v. 8.2) libvpx-1.7.0-8.el8_2
- Red Hat Enterprise Linux AppStream TUS (v. 8.2) libvpx-1.7.0-8.el8_2
- RHSA-2023:5535 Released 2023-10-09 · Red Hat rating Importantlibvpx security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.1) libvpx-1.7.0-8.el8_1
Show 20 more Red Hat advisories
- RHSA-2023:5537 Released 2023-10-09 · Red Hat rating Importantlibvpx security update
- Red Hat Enterprise Linux AppStream (v. 8) libvpx-1.7.0-10.el8_8
- Red Hat Enterprise Linux CRB (v. 8) libvpx-devel-1.7.0-10.el8_8
- RHSA-2023:5536 Released 2023-10-09 · Red Hat rating Importantlibvpx security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) libvpx-1.7.0-10.el8_4
- Red Hat Enterprise Linux AppStream E4S (v.8.4) libvpx-1.7.0-10.el8_4
- Red Hat Enterprise Linux AppStream TUS (v.8.4) libvpx-1.7.0-10.el8_4
- RHSA-2023:5539 Released 2023-10-09 · Red Hat rating Importantlibvpx security update
- Red Hat Enterprise Linux AppStream (v. 9) libvpx-1.9.0-7.el9_2
- Red Hat Enterprise Linux CRB (v. 9) libvpx-devel-1.9.0-7.el9_2
- RHSA-2023:5540 Released 2023-10-09 · Red Hat rating Importantlibvpx security update
- Red Hat CodeReady Linux Builder EUS (v.9.0) libvpx-devel-1.9.0-7.el9_0
- Red Hat Enterprise Linux AppStream EUS (v.9.0) libvpx-1.9.0-7.el9_0
- RHSA-2023:5475 Released 2023-10-05 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux Client (v. 7) thunderbird-115.3.1-1.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-115.3.1-1.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) thunderbird-115.3.1-1.el7_9
- RHSA-2023:5477 Released 2023-10-05 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux Client (v. 7) firefox-115.3.1-1.el7_9
- Red Hat Enterprise Linux Client Optional (v. 7) firefox-115.3.1-1.el7_9
- Red Hat Enterprise Linux Server (v. 7) firefox-115.3.1-1.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7) firefox-115.3.1-1.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) firefox-115.3.1-1.el7_9
- Red Hat Enterprise Linux Workstation Optional (v. 7) firefox-115.3.1-1.el7_9
- RHSA-2023:5429 Released 2023-10-04 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) thunderbird-115.3.1-1.el8_4
- Red Hat Enterprise Linux AppStream E4S (v.8.4) thunderbird-115.3.1-1.el8_4
- Red Hat Enterprise Linux AppStream TUS (v.8.4) thunderbird-115.3.1-1.el8_4
- RHSA-2023:5434 Released 2023-10-04 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream (v. 9) firefox-115.3.1-1.el9_2, firefox-x11-115.3.1-1.el9_2
- RHSA-2023:5438 Released 2023-10-04 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.1) thunderbird-115.3.1-1.el8_1
- RHSA-2023:5426 Released 2023-10-04 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) firefox-115.3.1-1.el8_2
- Red Hat Enterprise Linux AppStream E4S (v. 8.2) firefox-115.3.1-1.el8_2
- Red Hat Enterprise Linux AppStream TUS (v. 8.2) firefox-115.3.1-1.el8_2
- RHSA-2023:5432 Released 2023-10-04 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) thunderbird-115.3.1-1.el8_2
- Red Hat Enterprise Linux AppStream E4S (v. 8.2) thunderbird-115.3.1-1.el8_2
- Red Hat Enterprise Linux AppStream TUS (v. 8.2) thunderbird-115.3.1-1.el8_2
- RHSA-2023:5433 Released 2023-10-04 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream (v. 8) firefox-115.3.1-1.el8_8
- RHSA-2023:5437 Released 2023-10-04 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox-115.3.1-1.el8_4
- Red Hat Enterprise Linux AppStream E4S (v.8.4) firefox-115.3.1-1.el8_4
- Red Hat Enterprise Linux AppStream TUS (v.8.4) firefox-115.3.1-1.el8_4
- RHSA-2023:5440 Released 2023-10-04 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.1) firefox-115.3.1-1.el8_1
- RHSA-2023:5439 Released 2023-10-04 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream EUS (v.9.0) thunderbird-115.3.1-1.el9_0
- RHSA-2023:5436 Released 2023-10-04 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) firefox-115.3.1-1.el8_6
- RHSA-2023:5435 Released 2023-10-04 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream (v. 9) thunderbird-115.3.1-1.el9_2
- RHSA-2023:5430 Released 2023-10-04 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) thunderbird-115.3.1-1.el8_6
- RHSA-2023:5428 Released 2023-10-04 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream (v. 8) thunderbird-115.3.1-1.el8_8
- RHSA-2023:5427 Released 2023-10-04 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream EUS (v.9.0) firefox-115.3.1-1.el9_0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Google Chrome 117.0.5938.132
3 records Highest priority Priority CRITICAL 1 CRITICAL, 2 MEDIUM
Other records, highest priority first
- TI-2023-04775 Use after free in Google ChromePriority MEDIUM 40
- TI-2023-04774 Use after free in Google ChromePriority MEDIUM 40
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat CodeReady Linux Builder EUS (v.8.6) | Fixed | RHSA-2023:5538 |
| Red Hat CodeReady Linux Builder EUS (v.9.0) | Fixed | RHSA-2023:5540 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:5428, RHSA-2023:5433, RHSA-2023:5537 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:5434, RHSA-2023:5435, RHSA-2023:5539 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2023:5426, RHSA-2023:5432, RHSA-2023:5534 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2023:5429, RHSA-2023:5437, RHSA-2023:5536 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.1) | Fixed | RHSA-2023:5438, RHSA-2023:5440, RHSA-2023:5535 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.2) | Fixed | RHSA-2023:5426, RHSA-2023:5432, RHSA-2023:5534 |
| Red Hat Enterprise Linux AppStream E4S (v.8.4) | Fixed | RHSA-2023:5429, RHSA-2023:5437, RHSA-2023:5536 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2023:5430, RHSA-2023:5436, RHSA-2023:5538 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2023:5427, RHSA-2023:5439, RHSA-2023:5540 |
| Red Hat Enterprise Linux AppStream TUS (v. 8.2) | Fixed | RHSA-2023:5426, RHSA-2023:5432, RHSA-2023:5534 |
| Red Hat Enterprise Linux AppStream TUS (v.8.4) | Fixed | RHSA-2023:5429, RHSA-2023:5437, RHSA-2023:5536 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2023:5537 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2023:5539 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2023:5475, RHSA-2023:5477 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2023:5477 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2023:5477 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2023:5475, RHSA-2023:5477 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2023:5475, RHSA-2023:5477 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2023:5477 |
Not affected: 1 product
- Red Hat Enterprise Linux 7
Timeline
- 2023-10-02 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2023-5217
- 2026-10-03 Alias added: GHSA-qqvq-6xgj-jw8g
References
Exploit 1
Patch 4
Advisory 32
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- http://www.openwall.com/lists/oss-security/2023/09/29/1
- http://www.openwall.com/lists/oss-security/2023/09/29/2
- http://www.openwall.com/lists/oss-security/2023/09/29/7
- http://www.openwall.com/lists/oss-security/2023/09/29/9
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/
- https://security-tracker.debian.org/tracker/CVE-2023-5217
- https://bugzilla.redhat.com/show_bug.cgi?id=2241191
- https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/
- https://www.openwall.com/lists/oss-security/2023/09/28/5
- http://www.openwall.com/lists/oss-security/2023/09/29/11
- http://www.openwall.com/lists/oss-security/2023/09/29/12
- http://www.openwall.com/lists/oss-security/2023/09/29/14
- http://www.openwall.com/lists/oss-security/2023/09/30/1
- https://twitter.com/maddiestone/status/1707163313711497266
- https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/
- http://www.openwall.com/lists/oss-security/2023/09/30/3
- http://www.openwall.com/lists/oss-security/2023/09/30/2
- http://www.openwall.com/lists/oss-security/2023/09/30/4
- http://www.openwall.com/lists/oss-security/2023/09/30/5
- http://www.openwall.com/lists/oss-security/2023/10/01/2
- http://www.openwall.com/lists/oss-security/2023/10/01/1
- http://www.openwall.com/lists/oss-security/2023/10/01/5
- http://www.openwall.com/lists/oss-security/2023/10/02/6
- http://www.openwall.com/lists/oss-security/2023/10/03/11
- https://security.gentoo.org/glsa/202310-04
- https://support.apple.com/kb/HT213961
- http://seclists.org/fulldisclosure/2023/Oct/12
- https://support.apple.com/kb/HT213972
- http://seclists.org/fulldisclosure/2023/Oct/16
- https://security.gentoo.org/glsa/202401-34
- https://nvd.nist.gov/vuln/detail/CVE-2023-5217
Other 37
- https://pastebin.com/TdkC4pDv
- https://github.com/webmproject/libvpx/tags
- https://www.debian.org/security/2023/dsa-5510
- https://www.debian.org/security/2023/dsa-5509
- https://www.debian.org/security/2023/dsa-5508
- https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html
- https://github.com/webmproject/libvpx/releases/tag/v1.13.1
- https://lists.fedoraproject.org/archives/list/[email protected]/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/
- https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/
- https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/
- https://github.com/electron/electron/pull/40022
- https://github.com/electron/electron/pull/40023
- https://github.com/electron/electron/pull/40024
- https://github.com/electron/electron/pull/40025
- https://github.com/electron/electron/pull/40026
- https://lists.fedoraproject.org/archives/list/[email protected]/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63
- https://lists.fedoraproject.org/archives/list/[email protected]/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I
- https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-44
- https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software
- https://github.com/electron/electron
- https://github.com/electron/electron/releases/tag/v22.3.25
- https://github.com/electron/electron/releases/tag/v24.8.5
- https://github.com/electron/electron/releases/tag/v25.8.4
- https://github.com/electron/electron/releases/tag/v26.2.4
- https://github.com/electron/electron/releases/tag/v27.0.0-beta.8
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4
- https://lists.fedoraproject.org/archives/list/[email protected]/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD
More Google Chrome vulnerabilities
- TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
- TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
Sources
- CVE-2023-5217 · CVE Program
- CVE-2023-5217 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-qqvq-6xgj-jw8g · GitHub Advisory Database · CC BY 4.0
- CVE-2023-5217 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences