Known Exploited Vulnerability
8.8
HIGH
CVE-2023-5217
Google Chrome libvpx Heap Buffer Overflow Vulnerab - [Actively Exploited]
Description

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

INFO

Published Date :

Sept. 28, 2023, 4:15 p.m.

Last Modified :

Dec. 20, 2024, 7:01 p.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

2.8
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.

Required Action :

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes :

https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html; https://nvd.nist.gov/vuln/detail/CVE-2023-5217

Public PoC/Exploit Available at Github

CVE-2023-5217 has a 10 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2023-5217 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Mozilla firefox
2 Mozilla firefox_esr
3 Mozilla thunderbird
4 Mozilla firefox_focus
1 Microsoft edge
2 Microsoft edge_chromium
1 Apple iphone_os
2 Apple ipad_os
1 Redhat enterprise_linux
1 Fedoraproject fedora
1 Debian debian_linux
1 Google chrome
1 Electronjs electron
1 Webmproject libvpx
: Total Affected Vendor : 9 | Products : 14
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2023-5217.

URL Resource
http://seclists.org/fulldisclosure/2023/Oct/12 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/16 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/28/5 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/28/6 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/11 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/12 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/14 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/7 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/9 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/30/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/30/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/30/3 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/30/4 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/30/5 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/01/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/01/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/01/5 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/02/6 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/03/11 Mailing List Third Party Advisory
https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/ Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2241191 Issue Tracking Third Party Advisory
https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html Vendor Advisory
https://crbug.com/1486441 Exploit Issue Tracking
https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590 Patch
https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282 Patch
https://github.com/webmproject/libvpx/releases/tag/v1.13.1 Release Notes
https://github.com/webmproject/libvpx/tags Product
https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ Mailing List
https://pastebin.com/TdkC4pDv Not Applicable
https://security-tracker.debian.org/tracker/CVE-2023-5217 Third Party Advisory
https://security.gentoo.org/glsa/202310-04 Third Party Advisory
https://security.gentoo.org/glsa/202401-34 Third Party Advisory
https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/ Third Party Advisory
https://support.apple.com/kb/HT213961 Third Party Advisory
https://support.apple.com/kb/HT213972 Third Party Advisory
https://twitter.com/maddiestone/status/1707163313711497266 Third Party Advisory
https://www.debian.org/security/2023/dsa-5508 Mailing List
https://www.debian.org/security/2023/dsa-5509 Mailing List
https://www.debian.org/security/2023/dsa-5510 Mailing List
https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/ Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/09/28/5 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/12 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/16 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/28/5 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/28/6 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/11 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/12 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/14 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/7 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/29/9 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/30/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/30/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/30/3 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/30/4 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/30/5 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/01/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/01/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/01/5 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/02/6 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/03/11 Mailing List Third Party Advisory
https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/ Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2241191 Issue Tracking Third Party Advisory
https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html Vendor Advisory
https://crbug.com/1486441 Exploit Issue Tracking
https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590 Patch
https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282 Patch
https://github.com/webmproject/libvpx/releases/tag/v1.13.1 Release Notes
https://github.com/webmproject/libvpx/tags Product
https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ Mailing List
https://pastebin.com/TdkC4pDv Not Applicable
https://security-tracker.debian.org/tracker/CVE-2023-5217 Third Party Advisory
https://security.gentoo.org/glsa/202310-04 Third Party Advisory
https://security.gentoo.org/glsa/202401-34 Third Party Advisory
https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/ Third Party Advisory
https://support.apple.com/kb/HT213961 Third Party Advisory
https://support.apple.com/kb/HT213972 Third Party Advisory
https://twitter.com/maddiestone/status/1707163313711497266 Third Party Advisory
https://www.debian.org/security/2023/dsa-5508 Mailing List
https://www.debian.org/security/2023/dsa-5509 Mailing List
https://www.debian.org/security/2023/dsa-5510 Mailing List
https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/ Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/09/28/5 Mailing List Third Party Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
sp25-tiktag/tiktag

None

Makefile C++ C Shell JavaScript WebAssembly HTML

Updated: 3 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : Aug. 21, 2024, 12:44 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
compsec-snu/tiktag

TikTag: Breaking ARM's Memory Tagging Extension with Speculative Execution (IEEE S&P 2025)

mte arm64

Makefile C++ C Shell JavaScript WebAssembly HTML

Updated: 3 weeks, 5 days ago
53 stars 10 fork 10 watcher
Born at : June 11, 2024, 12:59 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
Jereanny14/jereanny14.github.io

jereanny14

cibersecurity proyecto-web

Updated: 1 year, 1 month ago
0 stars 0 fork 0 watcher
Born at : Nov. 15, 2023, 2:45 a.m. This repo has been linked 2 different CVEs too.
Profile Photo
Trinadh465/platform_external_libvpx_v1.4.0_CVE-2023-5217

None

C Makefile Perl Shell C++ Python Assembly

Updated: 1 year, 2 months ago
0 stars 0 fork 0 watcher
Born at : Oct. 6, 2023, 11:01 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
Trinadh465/platform_external_libvpx_v1.8.0_CVE-2023-5217

None

C Makefile Perl Shell C++ Python Assembly

Updated: 1 year, 2 months ago
0 stars 0 fork 0 watcher
Born at : Oct. 6, 2023, 10:43 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
UT-Security/cve-2023-5217-poc

A PoC to trigger CVE-2023-5217 from the Browser WebCodecs or MediaRecorder interface.

HTML JavaScript Shell Python

Updated: 3 months, 3 weeks ago
15 stars 5 fork 5 watcher
Born at : Oct. 6, 2023, 5:46 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
RENANZG/My-Forensics

Digital Forensics and Incident Response (DFIR)

investigator babko backdoor honeypot criminal darknet forensics encrochat omerta interception government-hacking police-hacking rasterfahndung online-durchsuchungen technocolonialism zeroday-feature equipment-interference technical-capability-notice network-investigative-technique due-diligence

HTML Shell YARA

Updated: 2 weeks, 6 days ago
96 stars 14 fork 14 watcher
Born at : Aug. 21, 2023, 8:57 p.m. This repo has been linked 19 different CVEs too.
Profile Photo
RENANZG/My-Debian-GNU-Linux

Collection of Solutions for Debian GNU/Linux End Users

debian hardening security anticensorship freedom hashcheck secure-boot dkms shim encryption keyfile openssl sbsigntool mokutil sign-file grub postmodernism

Shell Python HTML Vim Script TeX CSS PowerShell Dockerfile JavaScript Makefile

Updated: 2 weeks, 6 days ago
5 stars 0 fork 0 watcher
Born at : July 14, 2023, 1:06 a.m. This repo has been linked 16 different CVEs too.
Profile Photo
Threekiii/CVE

一个CVE漏洞预警知识库 no exp/poc

Updated: 1 month, 1 week ago
95 stars 11 fork 11 watcher
Born at : Jan. 5, 2023, 2:19 a.m. This repo has been linked 133 different CVEs too.
Profile Photo
Ostorlab/KEV

Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.

cisa-kev vulnerability 0day cisa exploits

Updated: 2 weeks, 1 day ago
548 stars 35 fork 35 watcher
Born at : April 19, 2022, 8:58 a.m. This repo has been linked 1228 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2023-5217 vulnerability anywhere in the article.

  • BleepingComputer
Apple fixes two zero-days used in attacks on Intel-based Macs

Apple released emergency security updates to fix two zero-day vulnerabilities that were exploited in attacks on Intel-based Mac systems. "Apple is aware of a report that this issue may have been explo ... Read more

Published Date: Nov 19, 2024 (1 month ago)
CVE-2024-44309 CVE-2024-44308 CVE-2023-42917 CVE-2023-42916 CVE-2023-42824 CVE-2023-5217 CVE-2023-41993 CVE-2023-41992 CVE-2023-41991 CVE-2023-41064 ...+12 more CVE

The following table lists the changes that have been made to the CVE-2023-5217 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Modified Analysis by [email protected]

    Dec. 20, 2024

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions up to (excluding) 118.0.1 *cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 *cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* versions up to (excluding) 115.3.1 *cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 *cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* versions up to (excluding) 115.3.1 OR *cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* versions up to (excluding) 115.3.1 *cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* versions up to (excluding) 118.0.1 *cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 *cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* versions up to (excluding) 115.3.1
    Changed CPE Configuration AND OR cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 117.0.5938.132 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions up to (excluding) 118.0.1 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* versions up to (excluding) 115.3.1 cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 OR *cpe:2.3:a:webmproject:libvpx:*:*:*:*:*:*:*:* versions up to (excluding) 1.13.1 OR *cpe:2.3:a:webmproject:libvpx:*:*:*:*:*:*:*:* versions up to (excluding) 1.13.1
    Added CPE Configuration OR *cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 117.0.5938.132
    Added CPE Configuration OR *cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
    Changed Reference Type https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html Release Notes, Vendor Advisory https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html Vendor Advisory
    Changed Reference Type https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html Release Notes, Vendor Advisory https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html Vendor Advisory
    Changed Reference Type https://crbug.com/1486441 Issue Tracking, Permissions Required https://crbug.com/1486441 Exploit, Issue Tracking
    Changed Reference Type https://crbug.com/1486441 Issue Tracking, Permissions Required https://crbug.com/1486441 Exploit, Issue Tracking
    Changed Reference Type https://security-tracker.debian.org/tracker/CVE-2023-5217 Patch, Third Party Advisory https://security-tracker.debian.org/tracker/CVE-2023-5217 Third Party Advisory
    Changed Reference Type https://security-tracker.debian.org/tracker/CVE-2023-5217 Patch, Third Party Advisory https://security-tracker.debian.org/tracker/CVE-2023-5217 Third Party Advisory
    Changed Reference Type https://www.debian.org/security/2023/dsa-5508 Third Party Advisory https://www.debian.org/security/2023/dsa-5508 Mailing List
    Changed Reference Type https://www.debian.org/security/2023/dsa-5508 Third Party Advisory https://www.debian.org/security/2023/dsa-5508 Mailing List
    Changed Reference Type https://www.debian.org/security/2023/dsa-5509 Third Party Advisory https://www.debian.org/security/2023/dsa-5509 Mailing List
    Changed Reference Type https://www.debian.org/security/2023/dsa-5509 Third Party Advisory https://www.debian.org/security/2023/dsa-5509 Mailing List
    Changed Reference Type https://www.debian.org/security/2023/dsa-5510 Third Party Advisory https://www.debian.org/security/2023/dsa-5510 Mailing List
    Changed Reference Type https://www.debian.org/security/2023/dsa-5510 Third Party Advisory https://www.debian.org/security/2023/dsa-5510 Mailing List
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference http://seclists.org/fulldisclosure/2023/Oct/12
    Added Reference http://seclists.org/fulldisclosure/2023/Oct/16
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/28/5
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/28/6
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/1
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/11
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/12
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/14
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/2
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/7
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/9
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/30/1
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/30/2
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/30/3
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/30/4
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/30/5
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/01/1
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/01/2
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/01/5
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/02/6
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/03/11
    Added Reference https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/
    Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2241191
    Added Reference https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
    Added Reference https://crbug.com/1486441
    Added Reference https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
    Added Reference https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282
    Added Reference https://github.com/webmproject/libvpx/releases/tag/v1.13.1
    Added Reference https://github.com/webmproject/libvpx/tags
    Added Reference https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html
    Added Reference https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html
    Added Reference https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
    Added Reference https://pastebin.com/TdkC4pDv
    Added Reference https://security.gentoo.org/glsa/202310-04
    Added Reference https://security.gentoo.org/glsa/202401-34
    Added Reference https://security-tracker.debian.org/tracker/CVE-2023-5217
    Added Reference https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/
    Added Reference https://support.apple.com/kb/HT213961
    Added Reference https://support.apple.com/kb/HT213972
    Added Reference https://twitter.com/maddiestone/status/1707163313711497266
    Added Reference https://www.debian.org/security/2023/dsa-5508
    Added Reference https://www.debian.org/security/2023/dsa-5509
    Added Reference https://www.debian.org/security/2023/dsa-5510
    Added Reference https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/
    Added Reference https://www.openwall.com/lists/oss-security/2023/09/28/5
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

    Feb. 15, 2024

    Action Type Old Value New Value
    Changed Vulnerability Name Google Chrome libvpx Heap Buffer Overflow Vulnerability Google Chromium libvpx Heap Buffer Overflow Vulnerability
  • Modified Analysis by [email protected]

    Feb. 02, 2024

    Action Type Old Value New Value
    Changed Reference Type https://security.gentoo.org/glsa/202401-34 No Types Assigned https://security.gentoo.org/glsa/202401-34 Third Party Advisory
    Changed CPE Configuration AND OR *cpe:2.3:a:webmproject:libvpx:1.13.1:*:*:*:*:*:*:* OR cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 117.0.5938.132 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions up to (excluding) 118.0.1 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* versions up to (excluding) 115.3.1 cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 AND OR *cpe:2.3:a:webmproject:libvpx:*:*:*:*:*:*:*:* versions up to (excluding) 1.13.1 OR cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 117.0.5938.132 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions up to (excluding) 118.0.1 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* versions up to (excluding) 115.3.1 cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:android:*:* versions up to (excluding) 118.1
  • CVE Modified by [email protected]

    Jan. 31, 2024

    Action Type Old Value New Value
    Added Reference Chrome https://security.gentoo.org/glsa/202401-34 [No types assigned]
  • Modified Analysis by [email protected]

    Nov. 17, 2023

    Action Type Old Value New Value
    Changed Reference Type https://support.apple.com/kb/HT213961 No Types Assigned https://support.apple.com/kb/HT213961 Third Party Advisory
    Changed Reference Type https://support.apple.com/kb/HT213972 No Types Assigned https://support.apple.com/kb/HT213972 Third Party Advisory
    Added CPE Configuration OR *cpe:2.3:o:apple:ipad_os:16.7:*:*:*:*:*:*:* *cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:* versions from (including) 17.0 up to (excluding) 17.0.3 *cpe:2.3:o:apple:iphone_os:16.7:*:*:*:*:*:*:* *cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* versions from (including) 17.0 up to (excluding) 17.0.3
  • CVE Modified by [email protected]

    Nov. 15, 2023

    Action Type Old Value New Value
    Added Reference Chrome https://support.apple.com/kb/HT213972 [No types assigned]
  • CVE Modified by [email protected]

    Nov. 15, 2023

    Action Type Old Value New Value
    Added Reference Chrome https://support.apple.com/kb/HT213961 [No types assigned]
  • Modified Analysis by [email protected]

    Oct. 24, 2023

    Action Type Old Value New Value
    Changed Reference Type http://seclists.org/fulldisclosure/2023/Oct/12 No Types Assigned http://seclists.org/fulldisclosure/2023/Oct/12 Mailing List, Third Party Advisory
    Changed Reference Type http://seclists.org/fulldisclosure/2023/Oct/16 No Types Assigned http://seclists.org/fulldisclosure/2023/Oct/16 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/29/11 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/29/11 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/29/12 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/29/12 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/29/14 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/29/14 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/29/7 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/29/7 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/29/9 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/29/9 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/30/1 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/30/1 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/30/2 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/30/2 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/30/3 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/30/3 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/30/4 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/30/4 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/30/5 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/30/5 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/10/01/1 No Types Assigned http://www.openwall.com/lists/oss-security/2023/10/01/1 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/10/01/2 No Types Assigned http://www.openwall.com/lists/oss-security/2023/10/01/2 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/10/01/5 No Types Assigned http://www.openwall.com/lists/oss-security/2023/10/01/5 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/10/02/6 No Types Assigned http://www.openwall.com/lists/oss-security/2023/10/02/6 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/10/03/11 No Types Assigned http://www.openwall.com/lists/oss-security/2023/10/03/11 Mailing List, Third Party Advisory
    Changed Reference Type https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/ No Types Assigned https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/ Third Party Advisory
    Changed Reference Type https://bugzilla.redhat.com/show_bug.cgi?id=2241191 No Types Assigned https://bugzilla.redhat.com/show_bug.cgi?id=2241191 Issue Tracking, Third Party Advisory
    Changed Reference Type https://crbug.com/1486441 Permissions Required https://crbug.com/1486441 Issue Tracking, Permissions Required
    Changed Reference Type https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590 No Types Assigned https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590 Patch
    Changed Reference Type https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282 No Types Assigned https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282 Patch
    Changed Reference Type https://github.com/webmproject/libvpx/releases/tag/v1.13.1 No Types Assigned https://github.com/webmproject/libvpx/releases/tag/v1.13.1 Release Notes
    Changed Reference Type https://github.com/webmproject/libvpx/tags No Types Assigned https://github.com/webmproject/libvpx/tags Product
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html No Types Assigned https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html Mailing List
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html No Types Assigned https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html Mailing List
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html No Types Assigned https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/ Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/ Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/ Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/ Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/ Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/ Mailing List
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ Mailing List
    Changed Reference Type https://pastebin.com/TdkC4pDv No Types Assigned https://pastebin.com/TdkC4pDv Not Applicable
    Changed Reference Type https://security.gentoo.org/glsa/202310-04 No Types Assigned https://security.gentoo.org/glsa/202310-04 Third Party Advisory
    Changed Reference Type https://security-tracker.debian.org/tracker/CVE-2023-5217 No Types Assigned https://security-tracker.debian.org/tracker/CVE-2023-5217 Patch, Third Party Advisory
    Changed Reference Type https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/ No Types Assigned https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/ Third Party Advisory
    Changed Reference Type https://twitter.com/maddiestone/status/1707163313711497266 No Types Assigned https://twitter.com/maddiestone/status/1707163313711497266 Third Party Advisory
    Changed Reference Type https://www.debian.org/security/2023/dsa-5508 No Types Assigned https://www.debian.org/security/2023/dsa-5508 Third Party Advisory
    Changed Reference Type https://www.debian.org/security/2023/dsa-5509 No Types Assigned https://www.debian.org/security/2023/dsa-5509 Third Party Advisory
    Changed Reference Type https://www.debian.org/security/2023/dsa-5510 No Types Assigned https://www.debian.org/security/2023/dsa-5510 Third Party Advisory
    Changed Reference Type https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/ No Types Assigned https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/ Third Party Advisory
    Changed Reference Type https://www.openwall.com/lists/oss-security/2023/09/28/5 No Types Assigned https://www.openwall.com/lists/oss-security/2023/09/28/5 Mailing List, Third Party Advisory
    Added CPE Configuration OR *cpe:2.3:a:microsoft:edge:116.0.1938.98:*:*:*:*:*:*:* *cpe:2.3:a:microsoft:edge:117.0.2045.47:*:*:*:*:*:*:* *cpe:2.3:a:microsoft:edge_chromium:116.0.5845.229:*:*:*:*:*:*:* *cpe:2.3:a:microsoft:edge_chromium:117.0.5938.132:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions up to (excluding) 118.0.1 *cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 *cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* versions up to (excluding) 115.3.1 *cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 *cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* versions up to (excluding) 115.3.1
    Added CPE Configuration OR *cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Oct. 23, 2023

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/ [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 17, 2023

    Action Type Old Value New Value
    Added Reference http://seclists.org/fulldisclosure/2023/Oct/16 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 09, 2023

    Action Type Old Value New Value
    Added Reference https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 06, 2023

    Action Type Old Value New Value
    Added Reference http://seclists.org/fulldisclosure/2023/Oct/12 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 05, 2023

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/ [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 04, 2023

    Action Type Old Value New Value
    Added Reference https://security.gentoo.org/glsa/202310-04 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 04, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/03/11 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 02, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/02/6 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 02, 2023

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/ [No Types Assigned]
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/ [No Types Assigned]
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/ [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 02, 2023

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 01, 2023

    Action Type Old Value New Value
    Added Reference https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 01, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/01/5 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 01, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/01/2 [No Types Assigned]
    Added Reference http://www.openwall.com/lists/oss-security/2023/10/01/1 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 01, 2023

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/ [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 01, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/30/5 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 01, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/30/4 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 30, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/30/2 [No Types Assigned]
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/30/3 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 30, 2023

    Action Type Old Value New Value
    Added Reference https://github.com/webmproject/libvpx/releases/tag/v1.13.1 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 30, 2023

    Action Type Old Value New Value
    Added Reference https://twitter.com/maddiestone/status/1707163313711497266 [No Types Assigned]
    Added Reference https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/ [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 30, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/30/1 [No Types Assigned]
    Added Reference https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 30, 2023

    Action Type Old Value New Value
    Added Reference https://www.debian.org/security/2023/dsa-5510 [No Types Assigned]
    Added Reference https://www.debian.org/security/2023/dsa-5508 [No Types Assigned]
    Added Reference https://www.debian.org/security/2023/dsa-5509 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 30, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/14 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 30, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/9 [No Types Assigned]
    Added Reference https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/ [No Types Assigned]
    Added Reference https://pastebin.com/TdkC4pDv [No Types Assigned]
    Added Reference https://github.com/webmproject/libvpx/tags [No Types Assigned]
    Added Reference https://security-tracker.debian.org/tracker/CVE-2023-5217 [No Types Assigned]
    Added Reference https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282 [No Types Assigned]
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/11 [No Types Assigned]
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/12 [No Types Assigned]
    Added Reference https://www.openwall.com/lists/oss-security/2023/09/28/5 [No Types Assigned]
    Added Reference https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590 [No Types Assigned]
    Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2241191 [No Types Assigned]
    Added Reference https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/ [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 29, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/7 [No Types Assigned]
  • Initial Analysis by [email protected]

    Sep. 29, 2023

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/28/5 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/28/5 Mailing List, Patch, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/28/6 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/28/6 Mailing List, Patch, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/29/1 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/29/1 Mailing List, Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/09/29/2 No Types Assigned http://www.openwall.com/lists/oss-security/2023/09/29/2 Mailing List, Third Party Advisory
    Changed Reference Type https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html No Types Assigned https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html Release Notes, Vendor Advisory
    Changed Reference Type https://crbug.com/1486441 No Types Assigned https://crbug.com/1486441 Permissions Required
    Added CWE NIST CWE-787
    Added CPE Configuration AND OR *cpe:2.3:a:webmproject:libvpx:1.13.1:*:*:*:*:*:*:* OR cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 117.0.5938.132 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions up to (excluding) 118.0.1 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:* versions up to (excluding) 118.1 cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* versions up to (excluding) 115.3.1 cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:android:*:* versions up to (excluding) 118.1
  • CVE Modified by [email protected]

    Sep. 29, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/1 [No Types Assigned]
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/29/2 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 29, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/28/6 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 28, 2023

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2023/09/28/5 [No Types Assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2023-5217 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2023-5217 weaknesses.

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

71.76 }} 32.20%

score

0.98254

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: