Known Exploited Vulnerability
8.8
HIGH
CVE-2023-5217
Google Chrome libvpx Heap Buffer Overflow Vulnerab - [Actively Exploited]
Description

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

INFO

Published Date :

Sept. 28, 2023, 4:15 p.m.

Last Modified :

Feb. 15, 2024, 2 a.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

2.8
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.

Required Action :

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes :

https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html

Public PoC/Exploit Available at Github

CVE-2023-5217 has a 11 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2023-5217 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Mozilla firefox
2 Mozilla firefox_esr
3 Mozilla thunderbird
4 Mozilla firefox_focus
1 Microsoft edge
2 Microsoft edge_chromium
1 Apple iphone_os
2 Apple ipad_os
1 Fedoraproject fedora
1 Debian debian_linux
1 Google chrome
1 Electronjs electron
1 Webmproject libvpx
: Total Affected Vendor : 8 | Products : 13
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2023-5217.

URL Resource
http://seclists.org/fulldisclosure/2023/Oct/12 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/16 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/28/5 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/28/6 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/11 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/12 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/14 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/7 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/9 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/30/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/30/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/30/3 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/30/4 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/30/5 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/01/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/01/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/01/5 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/02/6 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/03/11 Mailing List Third Party Advisory
https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/ Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2241191 Issue Tracking Third Party Advisory
https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html Release Notes Vendor Advisory
https://crbug.com/1486441 Issue Tracking Permissions Required
https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590 Patch
https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282 Patch
https://github.com/webmproject/libvpx/releases/tag/v1.13.1 Release Notes
https://github.com/webmproject/libvpx/tags Product
https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ Mailing List
https://pastebin.com/TdkC4pDv Not Applicable
https://security-tracker.debian.org/tracker/CVE-2023-5217 Patch Third Party Advisory
https://security.gentoo.org/glsa/202310-04 Third Party Advisory
https://security.gentoo.org/glsa/202401-34 Third Party Advisory
https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/ Third Party Advisory
https://support.apple.com/kb/HT213961 Third Party Advisory
https://support.apple.com/kb/HT213972 Third Party Advisory
https://twitter.com/maddiestone/status/1707163313711497266 Third Party Advisory
https://www.debian.org/security/2023/dsa-5508 Third Party Advisory
https://www.debian.org/security/2023/dsa-5509 Third Party Advisory
https://www.debian.org/security/2023/dsa-5510 Third Party Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/ Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/09/28/5 Mailing List Third Party Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
sp25-tiktag/tiktag

None

Makefile C++ C Shell JavaScript WebAssembly HTML

Updated: 2 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : Aug. 21, 2024, 12:44 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
compsec-snu/tiktag

TikTag: Breaking ARM's Memory Tagging Extension with Speculative Execution (IEEE S&P 2025)

mte arm64

Makefile C++ C Shell JavaScript WebAssembly HTML

Updated: 1 month, 1 week ago
48 stars 8 fork 8 watcher
Born at : June 11, 2024, 12:59 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
Jereanny14/jereanny14.github.io

jereanny14

cibersecurity proyecto-web

Updated: 1 year ago
0 stars 0 fork 0 watcher
Born at : Nov. 15, 2023, 2:45 a.m. This repo has been linked 2 different CVEs too.
Profile Photo
Trinadh465/platform_external_libvpx_v1.4.0_CVE-2023-5217

None

C Makefile Perl Shell C++ Python Assembly

Updated: 1 year, 1 month ago
0 stars 0 fork 0 watcher
Born at : Oct. 6, 2023, 11:01 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
Trinadh465/platform_external_libvpx_v1.8.0_CVE-2023-5217

None

C Makefile Perl Shell C++ Python Assembly

Updated: 1 year, 1 month ago
0 stars 0 fork 0 watcher
Born at : Oct. 6, 2023, 10:43 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
UT-Security/cve-2023-5217-poc

A PoC to trigger CVE-2023-5217 from the Browser WebCodecs or MediaRecorder interface.

HTML JavaScript Shell Python

Updated: 2 months, 3 weeks ago
15 stars 5 fork 5 watcher
Born at : Oct. 6, 2023, 5:46 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
RENANZG/My-Forensics

Digital Forensics and Incident Response (DFIR)

investigator babko backdoor honeypot criminal darknet forensics encrochat omerta interception government-hacking police-hacking rasterfahndung online-durchsuchungen technocolonialism zeroday-feature equipment-interference technical-capability-notice network-investigative-technique due-diligence

Shell HTML YARA

Updated: 2 months, 3 weeks ago
91 stars 14 fork 14 watcher
Born at : Aug. 21, 2023, 8:57 p.m. This repo has been linked 19 different CVEs too.
Profile Photo
RENANZG/My-Debian-GNU-Linux

Collection of Solutions for Debian GNU/Linux End Users

debian hardening security anticensorship freedom hashcheck secure-boot dkms shim encryption keyfile openssl sbsigntool mokutil sign-file grub postmodernism

Shell C Python HTML Vim Script Perl TeX CSS PowerShell Go

Updated: 2 months, 2 weeks ago
5 stars 0 fork 0 watcher
Born at : July 14, 2023, 1:06 a.m. This repo has been linked 16 different CVEs too.
Profile Photo
Threekiii/CVE

一个CVE漏洞预警知识库 no exp/poc

Updated: 3 months, 2 weeks ago
88 stars 10 fork 10 watcher
Born at : Jan. 5, 2023, 2:19 a.m. This repo has been linked 110 different CVEs too.
Profile Photo
Ostorlab/KEV

Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.

cisa-kev vulnerability 0day cisa exploits

Updated: 2 months, 2 weeks ago
516 stars 32 fork 32 watcher
Born at : April 19, 2022, 8:58 a.m. This repo has been linked 1181 different CVEs too.
Profile Photo
nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 2 months, 1 week ago
6375 stars 1107 fork 1107 watcher
Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 904 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2023-5217 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2023-5217 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

    Feb. 15, 2024

    Action Type Old Value New Value
    Changed Vulnerability Name Google Chrome libvpx Heap Buffer Overflow Vulnerability Google Chromium libvpx Heap Buffer Overflow Vulnerability
  • Modified Analysis by [email protected]

    Feb. 02, 2024

    Action Type Old Value New Value
    Changed Reference Type https://security.gentoo.org/glsa/202401-34 No Types Assigned https://security.gentoo.org/glsa/202401-34 Third Party Advisory
    Changed CPE Configuration AND OR *cpe:2.3:a:webmproject:libvpx:1.13.1:*:*:*:*:*:*:* OR cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 117.0.5938.132 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions up to (excluding) 118.0.1 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* versions up to (excluding) 115.3.1 cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 AND OR *cpe:2.3:a:webmproject:libvpx:*:*:*:*:*:*:*:* versions up to (excluding) 1.13.1 OR cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 117.0.5938.132 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions up to (excluding) 118.0.1 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* versions up to (excluding) 115.3.1 cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:android:*:* versions up to (excluding) 118.1
  • CVE Modified by [email protected]

    Jan. 31, 2024

    Action Type Old Value New Value
    Added Reference Chrome https://security.gentoo.org/glsa/202401-34 [No types assigned]
  • Modified Analysis by [email protected]

    Nov. 17, 2023

    Action Type Old Value New Value
    Changed Reference Type https://support.apple.com/kb/HT213961 No Types Assigned https://support.apple.com/kb/HT213961 Third Party Advisory
    Changed Reference Type https://support.apple.com/kb/HT213972 No Types Assigned https://support.apple.com/kb/HT213972 Third Party Advisory
    Added CPE Configuration OR *cpe:2.3:o:apple:ipad_os:16.7:*:*:*:*:*:*:* *cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:* versions from (including) 17.0 up to (excluding) 17.0.3 *cpe:2.3:o:apple:iphone_os:16.7:*:*:*:*:*:*:* *cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* versions from (including) 17.0 up to (excluding) 17.0.3
  • CVE Modified by [email protected]

    Nov. 15, 2023

    Action Type Old Value New Value
    Added Reference Chrome https://support.apple.com/kb/HT213972 [No types assigned]
  • CVE Modified by [email protected]

    Nov. 15, 2023

    Action Type Old Value New Value
    Added Reference Chrome https://support.apple.com/kb/HT213961 [No types assigned]
  • Modified Analysis by [email protected]

    Oct. 24, 2023

    Action Type Old Value New Value
    Changed Reference Type http://seclists.org/fulldisclosure/2023/Oct/12 No Types Assigned http://seclists.org/fulldisclosure/2023/Oct/12 Mailing List, Third Party Advisory
    Changed Reference Type http://seclists.org/fulldisclosure/2023/Oct/16 No Types Assigned http://seclists.org/fulldisclosure/2023/Oct/16 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/29/11 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/29/11 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/29/12 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/29/12 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/29/14 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/29/14 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/29/7 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/29/7 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/29/9 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/29/9 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/30/1 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/30/1 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/30/2 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/30/2 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/30/3 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/30/3 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/30/4 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/30/4 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/30/5 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/30/5 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/10/01/1 No Types Assigned http://www.openwall.com/lists/oss-security/2023/10/01/1 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/10/01/2 No Types Assigned http://www.openwall.com/lists/oss-security/2023/10/01/2 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/10/01/5 No Types Assigned http://www.openwall.com/lists/oss-security/2023/10/01/5 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/10/02/6 No Types Assigned http://www.openwall.com/lists/oss-security/2023/10/02/6 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/10/03/11 No Types Assigned http://www.openwall.com/lists/oss-security/2023/10/03/11 Mailing List, Third Party Advisory
    Changed Reference Type https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/ No Types Assigned https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/ Third Party Advisory
    Changed Reference Type https://bugzilla.redhat.com/show_bug.cgi?id=2241191 No Types Assigned https://bugzilla.redhat.com/show_bug.cgi?id=2241191 Issue Tracking, Third Party Advisory
    Changed Reference Type https://crbug.com/1486441 Permissions Required https://crbug.com/1486441 Issue Tracking, Permissions Required
    Changed Reference Type https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590 No Types Assigned https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590 Patch
    Changed Reference Type https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282 No Types Assigned https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282 Patch
    Changed Reference Type https://github.com/webmproject/libvpx/releases/tag/v1.13.1 No Types Assigned https://github.com/webmproject/libvpx/releases/tag/v1.13.1 Release Notes
    Changed Reference Type https://github.com/webmproject/libvpx/tags No Types Assigned https://github.com/webmproject/libvpx/tags Product
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html No Types Assigned https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html Mailing List
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html No Types Assigned https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html Mailing List
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html No Types Assigned https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/ Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/ Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/ Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/ Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/ Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/ Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ Mailing List
    Changed Reference Type https://pastebin.com/TdkC4pDv No Types Assigned https://pastebin.com/TdkC4pDv Not Applicable
    Changed Reference Type https://security.gentoo.org/glsa/202310-04 No Types Assigned https://security.gentoo.org/glsa/202310-04 Third Party Advisory
    Changed Reference Type https://security-tracker.debian.org/tracker/CVE-2023-5217 No Types Assigned https://security-tracker.debian.org/tracker/CVE-2023-5217 Patch, Third Party Advisory
    Changed Reference Type https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/ No Types Assigned https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/ Third Party Advisory
    Changed Reference Type https://twitter.com/maddiestone/status/1707163313711497266 No Types Assigned https://twitter.com/maddiestone/status/1707163313711497266 Third Party Advisory
    Changed Reference Type https://www.debian.org/security/2023/dsa-5508 No Types Assigned https://www.debian.org/security/2023/dsa-5508 Third Party Advisory
    Changed Reference Type https://www.debian.org/security/2023/dsa-5509 No Types Assigned https://www.debian.org/security/2023/dsa-5509 Third Party Advisory
    Changed Reference Type https://www.debian.org/security/2023/dsa-5510 No Types Assigned https://www.debian.org/security/2023/dsa-5510 Third Party Advisory
    Changed Reference Type https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/ No Types Assigned https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/ Third Party Advisory
    Changed Reference Type https://www.openwall.com/lists/oss-security/2023/09/28/5 No Types Assigned https://www.openwall.com/lists/oss-security/2023/09/28/5 Mailing List, Third Party Advisory
    Added CPE Configuration OR *cpe:2.3:a:microsoft:edge:116.0.1938.98:*:*:*:*:*:*:* *cpe:2.3:a:microsoft:edge:117.0.2045.47:*:*:*:*:*:*:* *cpe:2.3:a:microsoft:edge_chromium:116.0.5845.229:*:*:*:*:*:*:* *cpe:2.3:a:microsoft:edge_chromium:117.0.5938.132:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions up to (excluding) 118.0.1 *cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 *cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* versions up to (excluding) 115.3.1 *cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 *cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* versions up to (excluding) 115.3.1
    Added CPE Configuration OR *cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Oct. 23, 2023

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/ [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 17, 2023

    Action Type Old Value New Value
    Added Reference http://seclists.org/fulldisclosure/2023/Oct/16 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 09, 2023

    Action Type Old Value New Value
    Added Reference https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 06, 2023

    Action Type Old Value New Value
    Added Reference http://seclists.org/fulldisclosure/2023/Oct/12 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 05, 2023

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/ [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 04, 2023

    Action Type Old Value New Value
    Added Reference https://security.gentoo.org/glsa/202310-04 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 04, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/03/11 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 02, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/02/6 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 02, 2023

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/ [No Types Assigned]
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/ [No Types Assigned]
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/ [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 02, 2023

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 01, 2023

    Action Type Old Value New Value
    Added Reference https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 01, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/01/5 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 01, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/01/2 [No Types Assigned]
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/01/1 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 01, 2023

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/ [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 01, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/30/5 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 01, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/30/4 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 30, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/30/2 [No Types Assigned]
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/30/3 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 30, 2023

    Action Type Old Value New Value
    Added Reference https://github.com/webmproject/libvpx/releases/tag/v1.13.1 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 30, 2023

    Action Type Old Value New Value
    Added Reference https://twitter.com/maddiestone/status/1707163313711497266 [No Types Assigned]
    Added Reference https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/ [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 30, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/30/1 [No Types Assigned]
    Added Reference https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 30, 2023

    Action Type Old Value New Value
    Added Reference https://www.debian.org/security/2023/dsa-5510 [No Types Assigned]
    Added Reference https://www.debian.org/security/2023/dsa-5508 [No Types Assigned]
    Added Reference https://www.debian.org/security/2023/dsa-5509 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 30, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/14 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 30, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/9 [No Types Assigned]
    Added Reference https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/ [No Types Assigned]
    Added Reference https://pastebin.com/TdkC4pDv [No Types Assigned]
    Added Reference https://github.com/webmproject/libvpx/tags [No Types Assigned]
    Added Reference https://security-tracker.debian.org/tracker/CVE-2023-5217 [No Types Assigned]
    Added Reference https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282 [No Types Assigned]
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/11 [No Types Assigned]
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/12 [No Types Assigned]
    Added Reference https://www.openwall.com/lists/oss-security/2023/09/28/5 [No Types Assigned]
    Added Reference https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590 [No Types Assigned]
    Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2241191 [No Types Assigned]
    Added Reference https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/ [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 29, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/7 [No Types Assigned]
  • Initial Analysis by [email protected]

    Sep. 29, 2023

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/28/5 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/28/5 Mailing List, Patch, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/28/6 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/28/6 Mailing List, Patch, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/29/1 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/29/1 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/29/2 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/29/2 Mailing List, Third Party Advisory
    Changed Reference Type https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html No Types Assigned https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html Release Notes, Vendor Advisory
    Changed Reference Type https://crbug.com/1486441 No Types Assigned https://crbug.com/1486441 Permissions Required
    Added CWE NIST CWE-787
    Added CPE Configuration AND OR *cpe:2.3:a:webmproject:libvpx:1.13.1:*:*:*:*:*:*:* OR cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 117.0.5938.132 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions up to (excluding) 118.0.1 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* versions up to (excluding) 115.3.1 cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:android:*:* versions up to (excluding) 118.1
  • CVE Modified by [email protected]

    Sep. 29, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/1 [No Types Assigned]
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/2 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 29, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/28/6 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 28, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/28/5 [No Types Assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2023-5217 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2023-5217 weaknesses.

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

31.12 }} -9.94%

score

0.97083

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: