CVE-2023-4863

2023-09-1200:00:00

ubuntu.com

heap buffer overflow

libwebp

remote attacker

out of bounds memory write

html page

chromium

severity critical

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.609 Medium

EPSS

Percentile

97.8%

JSON

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187
and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds
memory write via a crafted HTML page. (Chromium security severity:
Critical)

Bugs

Notes

Author	Note
alexmurray	The Debian chromium source package is called chromium-browser in Ubuntu
mdeslaur	starting with Ubuntu 19.10, the chromium-browser package is just a script that installs the Chromium snap
rodrigo-zaiden	in libwebp source, it seems like the affected versions starts from 0.5.0, with a high probability that the commit f75dfbf2 is the one adding the issue. I can be wrong in my assumption but, at least, the reproducer available in the the-webp-0day blog post, reproduces in 0.5.0 but not in 0.4.4, and the buffer huffman_tables was added in the mentioned commit. in Ubuntu, libwebp versions earlier than 0.5.0 does not contain the affected code, hence are probably not affected.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchfirefox< 117.0.1+build2-0ubuntu0.20.04.1UNKNOWN
ubuntu18.04noarchlibwebp< 0.6.1-2ubuntu0.18.04.2+esm1UNKNOWN
ubuntu20.04noarchlibwebp< 0.6.1-2ubuntu0.20.04.3UNKNOWN
ubuntu22.04noarchlibwebp< 1.2.2-2ubuntu0.22.04.2UNKNOWN
ubuntu23.04noarchlibwebp< 1.2.4-0.1ubuntu0.23.04.2UNKNOWN
ubuntu23.10noarchlibwebp< 1.2.4-0.2ubuntu1UNKNOWN
ubuntu24.04noarchlibwebp< 1.2.4-0.2ubuntu1UNKNOWN
ubuntu20.04noarchthunderbird< 1:102.15.1+build1-0ubuntu0.20.04.1UNKNOWN
ubuntu22.04noarchthunderbird< 1:102.15.1+build1-0ubuntu0.22.04.1UNKNOWN
ubuntu23.04noarchthunderbird< 1:102.15.1+build1-0ubuntu0.23.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	firefox	< 117.0.1+build2-0ubuntu0.20.04.1	UNKNOWN
ubuntu	18.04	noarch	libwebp	< 0.6.1-2ubuntu0.18.04.2+esm1	UNKNOWN
ubuntu	20.04	noarch	libwebp	< 0.6.1-2ubuntu0.20.04.3	UNKNOWN
ubuntu	22.04	noarch	libwebp	< 1.2.2-2ubuntu0.22.04.2	UNKNOWN
ubuntu	23.04	noarch	libwebp	< 1.2.4-0.1ubuntu0.23.04.2	UNKNOWN
ubuntu	23.10	noarch	libwebp	< 1.2.4-0.2ubuntu1	UNKNOWN
ubuntu	24.04	noarch	libwebp	< 1.2.4-0.2ubuntu1	UNKNOWN
ubuntu	20.04	noarch	thunderbird	< 1:102.15.1+build1-0ubuntu0.20.04.1	UNKNOWN
ubuntu	22.04	noarch	thunderbird	< 1:102.15.1+build1-0ubuntu0.22.04.1	UNKNOWN
ubuntu	23.04	noarch	thunderbird	< 1:102.15.1+build1-0ubuntu0.23.04.1	UNKNOWN