CVE-2023-4863

Description

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

How to fix CVE-2023-4863

To remediate CVE-2023-4863, upgrade the affected package to a fixed version below.

• —upgrade to 1.2.2-r2 or later
• —upgrade to 0.9.3 or later
• —upgrade to 0.9.3 or later
• —upgrade to 0.1.8 or later
• —upgrade to 0.1.8 or later
• —upgrade to 0.2.6 or later
• —upgrade to 117.0.5938.62-1 or later
• —upgrade to 102.15.1esr-1~deb11u1 or later
• —upgrade to 102.15.1esr-1~deb10u1 or later
• —upgrade to 102.15.1esr-1~deb11u1 or later
• —upgrade to 0.6.1-2.1+deb11u2 or later
• —upgrade to 1.2.4-0.2+deb12u1 or later
• —upgrade to 0.6.1-2.1+deb11u2 or later
• —upgrade to 0.6.1-2+deb10u3 or later
• —upgrade to 1:102.15.1-1~deb11u1 or later
• —upgrade to 1:102.15.1-1~deb10u1 or later
• —upgrade to 1:102.15.1-1~deb11u1 or later
• —upgrade to 1.4.0 or later
• —upgrade to 22.3.24 or later
• —upgrade to 13.3.0 or later
• —upgrade to 13.3.0 or later
• —upgrade to 13.3.0 or later
• —upgrade to 13.3.0 or later
• —upgrade to 13.3.0 or later
• —upgrade to 13.3.0 or later
• —upgrade to 2.88.6 or later
• —upgrade to 2023.9.18 or later
• —upgrade to 4.8.1.78 or later
• —upgrade to 4.8.1.78 or later
• —upgrade to 4.8.1.78 or later
• —upgrade to 4.8.1.78 or later
• —upgrade to 10.0.1 or later
• —upgrade to 10.0.1 or later

Is CVE-2023-4863 being exploited?

Yes — CVE-2023-4863 is on the CISA Known Exploited Vulnerabilities (KEV) catalog. Patch immediately.

Affected packages (33)

• from 0, < 1.2.2-r2
• >= 0.0.0-0, < 0.9.3
• from 0, < 0.9.3
• from 0, < 0.1.8
• >= 0.0.0-0, < 0.1.8
• from 0, < 0.2.6
• from 0, < 117.0.5938.62-1
• from 0, < 102.15.1esr-1~deb11u1
• from 0, < 102.15.1esr-1~deb10u1
• from 0, < 102.15.1esr-1~deb11u1
• from 0, < 0.6.1-2.1+deb11u2

CVSS scores

References (71)

• ADVISORYgithub.com/cgohlke/imagecodecs/blob/v2023.9.18/CHANGES.rst
• ADVISORYgithub.com/opencv/opencv/wiki/ChangeLog#version481
• ADVISORYgithub.com/python-pillow/Pillow/blob/main/CHANGES.rst#1001-2023-09-15
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-4863