pywebp versions before v0.3.0 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. The vulnerability was a heap buffer overflow which allowed a remote attacker to perform an out of bounds memory write.

Patches

The problem has been patched upstream in libwebp 1.3.2.
pywebp was updated to bundle a patched version of libwebp in v0.3.0.

Workarounds

No known workarounds without upgrading.

References

https://www.rezilion.com/blog/rezilion-researchers-uncover-new-details-on-severity-of-google-chrome-zero-day-vulnerability-cve-2023-4863/
https://nvd.nist.gov/vuln/detail/CVE-2023-4863

Affected configurations

Vulners

Node

webp_express_projectwebp_expressRange<0.3.0wordpress

CPENameOperatorVersion
webplt0.3.0

CPE	Name	Operator	Version
	webp	lt	0.3.0

References

github.com/advisories/GHSA-f9pm-4g9p-6vm3

github.com/anibali/pywebp/commit/1f938731a158a6584977cec2cce21b21c15f6c4b

github.com/anibali/pywebp/security/advisories/GHSA-f9pm-4g9p-6vm3

osv 23

slackware 2

nessus 69

fedora 4

attackerkb 1

freebsd 2

prion 1

paloalto 1

mageia 1

cgr 1

oraclelinux 6

openvas 42

hp 1

cvelist 1

nvd 1

cve 1

githubexploit 3

kaspersky 3

github 3

alpinelinux 1

hivepro 1

almalinux 5

ibm 2

amazon 4

debian 5

debiancve 1

cloudfoundry 2

wolfi 1

cisa_kev 1

gitlab 1

rocky 2

cbl_mariner 1

redos 1

cnvd 1

chrome 1

thn 1

ubuntu 1

veracode 1

osv

libwebp - security update

2023-09-13 00:00:00

thunderbird - security update

2023-09-15 00:00:00

firefox-esr - security update

2023-09-16 00:00:00

slackware

[slackware-security] mozilla-thunderbird

2023-09-14 02:32:34

[slackware-security] seamonkey

2023-09-21 19:43:16

nessus

Mozilla Firefox ESR < 102.15.1

2023-09-13 00:00:00

Debian DSA-5497-1 : libwebp - security update

2023-09-14 00:00:00

Mozilla Firefox ESR < 102.15.1

2023-09-13 00:00:00

fedora

[SECURITY] Fedora 39 Update: libwebp-1.3.1-3.fc39

2023-09-15 19:54:26

[SECURITY] Fedora 37 Update: libwebp-1.3.1-3.fc37

2023-09-16 01:41:44

[SECURITY] Fedora 39 Update: firefox-117.0.1-2.fc39

2023-09-17 00:15:26

attackerkb

CVE-2023-4863

2023-09-12 00:00:00

freebsd

graphics/webp heap buffer overflow

2023-09-12 00:00:00

libwebp heap buffer overflow

2023-09-12 00:00:00

prion

Heap overflow

2023-09-12 15:15:00

paloalto

Impact of libwebp Vulnerability CVE-2023-4863

2023-10-02 23:40:00

mageia

Updated libwebp packages fix a security vulnerability

2023-10-03 13:53:29

cgr

CVE-2023-4863 vulnerabilities

2024-05-19 03:07:16

oraclelinux

thunderbird security update

2023-09-19 00:00:00

firefox security update

2023-09-19 00:00:00

libwebp security update

2023-09-20 00:00:00

openvas

Huawei EulerOS: Security Advisory for libwebp (EulerOS-SA-2024-1014)

2024-01-05 00:00:00

Huawei EulerOS: Security Advisory for libwebp (EulerOS-SA-2024-1280)

2024-03-12 00:00:00

openSUSE: Security Advisory for seamonkey (openSUSE-SU-2023:0278-1)

2024-03-04 00:00:00

Certain HP Enterprise LaserJet, HP LaserJet Managed Printers – Potential Buffer Overflow

2024-02-20 00:00:00

cvelist

CVE-2023-4863

2023-09-12 14:24:59

nvd

CVE-2023-4863

2023-09-12 15:15:24

cve

CVE-2023-4863

2023-09-12 15:15:24

githubexploit

Exploit for Out-of-bounds Write in Google Chrome

2023-11-11 06:51:03

Exploit for Out-of-bounds Write in Google Chrome

2023-09-21 05:22:51

Exploit for Out-of-bounds Write in Google Chrome

2023-12-18 23:12:25

kaspersky

KLA61312 DoS vulnerability in Opera

2023-09-13 00:00:00

KLA60569 DoS vulnerablity in Microsoft Browser

2023-09-12 00:00:00

KLA60003 DoS vulnerability in Google Chrome

2023-09-11 00:00:00

github

Vulnerable version of libwebp and can be exploited with a malicious source image

2023-10-06 20:46:33

libwebp: OOB write in BuildHuffmanTable

2023-09-12 15:30:20

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

2023-09-27 21:16:16

alpinelinux

CVE-2023-4863

2023-09-12 15:15:24

hivepro

Google Addresses Fourth Zero-Day Flaw Exploited by Attackers Wildly

2023-09-12 13:05:09

almalinux

Important: thunderbird security update

2023-09-19 00:00:00

Important: thunderbird security update

2023-09-18 00:00:00

Important: libwebp security update

2023-09-19 00:00:00

ibm

Security Bulletin: IBM App Connect Enterprise is vulnerable to a heap-based buffer overflow due to electron

2023-10-20 09:35:15

Security Bulletin: IBM Cognos Analytics Cartridge for IBM Cloud Pak for Data 4.8.0 has addressed a security vulnerability (CVE-2023-4863)

2023-11-29 22:25:21

amazon

Important: qt5-qtimageformats

2023-11-09 19:19:00

Important: thunderbird

2023-10-12 15:08:00

Important: libwebp12

2023-10-12 15:08:00

debian

[SECURITY] [DLA 3569-1] thunderbird security update

2023-09-17 09:42:33

[SECURITY] [DSA 5497-1] libwebp security update

2023-09-13 21:07:56

[SECURITY] [DSA 5497-2] libwebp security update

2023-09-17 15:33:28

debiancve

CVE-2023-4863

2023-09-12 15:15:24

cloudfoundry

USN-6369-1: libwebp vulnerability | Cloud Foundry

2023-10-12 00:00:00

| Cloud Foundry

2023-10-05 00:00:00

wolfi

CVE-2023-4863 vulnerabilities

2024-07-04 09:08:38

cisa_kev

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

2023-09-13 00:00:00

gitlab

CefSharp affected by heap buffer overflow in WebP

2023-09-21 00:00:00

rocky

libwebp security update

2023-09-26 13:26:19

firefox security update

2023-09-19 12:09:00

cbl_mariner

CVE-2023-4863 affecting package libwebp for versions less than 1.3.2-1

2023-10-04 16:53:46

redos

ROS-20230920-03

2023-09-20 00:00:00

cnvd

Google Chrome Buffer Overflow Vulnerability (CNVD-2023-71680)

2023-09-15 00:00:00

chrome

Stable Channel Update for Desktop

2023-09-11 00:00:00

thn

Mozilla Rushes to Patch WebP Critical Zero-Day Exploit in Firefox and Thunderbird

2023-09-13 01:50:00

ubuntu

Firefox vulnerability

2023-09-14 00:00:00

veracode

Heap Buffer Overflow

2023-09-15 13:45:13

Solutions

Vulnerabilities intelligence
Perimeter control tool
Linux scanner
Windows scanner
Developers SDK
Security Intelligence feeds

Database

Vulnerabilities
Exploits
Security News
BugBounty
Wild Exploited
Top Vulnerabilities
CVE Feed

Resources

Statics & Sources
Plugins
API docs
FAQ
Blog
Glossary

Company

About
Contacts
Pricing
EULA
Privacy Policy
Submission Policy
OpenSource

@2024 Vulners Inc

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.609 Medium

EPSS

Percentile

97.8%

JSON

Related for GHSA-F9PM-4G9P-6VM3