Google Chromium libvpx Heap Buffer Overflow Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 02/10/2023. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| chrome | < 117.0.5938.132 | 117.0.5938.132 |
| edge | = 116.0.1938.98= 117.0.2045.47 | |
| edge chromium | = 116.0.5845.229= 117.0.5938.132 | |
| firefox | < 115.3.1< 118.0.1< 118.1 | 115.3.1118.0.1118.1 |
| thunderbird | < 115.3.1 | 115.3.1 |
| libvpx | < 1.13.1 | 1.13.1 |
| electron | ≥ 24.0.0, < 24.8.5≥ 25.0.0, < 25.8.4≥ 26.0.0, < 26.2.4≥ 27.0.0-alpha.1, < 27.0.0-beta.8< 22.3.25 | 24.8.525.8.426.2.427.0.0-beta.822.3.25 |
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free