Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade firefox-x11Upgrade thunderbirdUpgrade firefoxUpgrade libvpxUpgrade libvpx-devel | Oct 10, 2023 | Sep 28, 2023 |
| Alpine Linux | — | Upgrade libvpxUpgrade firefox-esrUpgrade qt5-qtwebengine | Aug 22, 2024 | Sep 28, 2023 |
| Centos_linux | — | Upgrade firefoxUpgrade thunderbirdUpgrade thunderbird-debuginfoUpgrade firefox-debuginfo | Oct 5, 2023 | Sep 28, 2023 |
| Debian | — | Upgrade libvpxUpgrade chromiumUpgrade firefox-esrUpgrade thunderbird | Oct 2, 2023 | Sep 28, 2023 |
| Freebsd | — | Upgrade libvpxUpgrade chromiumUpgrade qt6-webengineUpgrade electron22Upgrade electron24Upgrade ungoogled-chromiumUpgrade electron25 | Sep 29, 2023 | Sep 29, 2023 |
| Gentoo Linux | — | Upgrade media-libs/libvpx.Upgrade www-client/google-chrome.Upgrade www-client/microsoft-edge.Upgrade www-client/chromium. | Oct 5, 2023 | Sep 28, 2023 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Sep 28, 2023 | Sep 27, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libvpx | Mar 13, 2024 | Sep 28, 2023 |
| Mfsa2023 44 | — | Upgrade to Mozilla Firefox ESR version 115.3.1Upgrade to Mozilla Firefox version 118.0.1 | Sep 29, 2023 | Sep 28, 2023 |
| Microsoft Edge | — | Update Microsoft Edge to the latest version | Oct 2, 2023 | Sep 29, 2023 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 115.3.1 | Oct 2, 2023 | Sep 28, 2023 |
| Oracle_linux | — | Upgrade libvpxUpgrade firefox-x11Upgrade firefoxUpgrade libvpx-develUpgrade thunderbird | Oct 5, 2023 | Sep 27, 2023 |
| Redhat_linux | — | Upgrade libvpx-utils-debuginfoUpgrade libvpx-debugsourceUpgrade firefox-x11No solution existsUpgrade thunderbird-debugsourceUpgrade firefox-debuginfoUpgrade firefox-debugsourceUpgrade thunderbird-debuginfoUpgrade libvpx-develUpgrade libvpxUpgrade firefoxUpgrade thunderbirdUpgrade libvpx-debuginfo | Oct 5, 2023 | Sep 28, 2023 |
| Rocky_linux | — | Upgrade libvpx-develUpgrade libvpx-debuginfoUpgrade libvpx-debugsourceUpgrade libvpx | Aug 15, 2024 | Sep 28, 2023 |
| Suse | — | Upgrade libvpx4-32bitUpgrade mozillafirefox-branding-upstreamUpgrade libvpx1Upgrade vlc-langUpgrade libvpx-develUpgrade mozillafirefox-translations-commonUpgrade mozillathunderbirdUpgrade vlc-noxUpgrade vlc-vdpauUpgrade vlc-qtUpgrade libvlccore9Upgrade libvpx7Upgrade mozillathunderbird-translations-otherUpgrade libvpx4Upgrade mozillafirefox-develUpgrade libvlc5Upgrade vlc-opencvUpgrade chromedriverUpgrade vlc-codec-gstreamerUpgrade vpx-toolsUpgrade mozillafirefox-translations-otherUpgrade mozillafirefoxUpgrade mozillathunderbird-translations-commonUpgrade vlcUpgrade vlc-jackUpgrade chromiumUpgrade libvpx1-32bitUpgrade libvpx7-32bitUpgrade operaUpgrade vlc-devel | Oct 2, 2023 | Sep 28, 2023 |
| Ubuntu | — | Upgrade libvpx5 (Ubuntu Pro)Upgrade libvpx1 (Ubuntu Pro)Upgrade libvpx6Upgrade libvpx7Upgrade thunderbirdUpgrade firefoxUpgrade libvpx3 (Ubuntu Pro) | Oct 3, 2023 | Sep 28, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 28, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub