oss-security - CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <bd99e07a-8d8c-4652-9089-7c0fc2e86409@oracle.com>
Date: Thu, 28 Sep 2023 11:37:23 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx

Google has announced another media parsing bug, this time correctly documenting
both the base library and Chrome versions affected in the CVE.

https://www.cve.org/CVERecord?id=CVE-2023-5217 states:

    Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to
    117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially
    exploit heap corruption via a crafted HTML page.
    (Chromium security severity: High)

Unfortunately, the bug report it points to is restricted access still:
https://crbug.com/1486441

But the Chrome release notes state:
    Google is aware that an exploit for CVE-2023-5217 exists in the wild.
https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html

Mozilla has put out their own security advisory at
https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/
and delivered fixes in Firefox 118.0.1, Firefox ESR 115.3.1,
Firefox Focus for Android 118.1, and Firefox for Android 118.1.

https://bugzilla.mozilla.org/show_bug.cgi?id=1855550 is also still
restricted access.

It does not appear that libvpx 1.13.1 has been released yet, but there
are two commits in its git repo with the 1486441 bug id listed:

https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282

Mozilla's commit references these two libvpx commit ids as well:
https://hg.mozilla.org/mozilla-central/rev/c53f5ef77b62b79af86951a7f9130e1896b695d2

-- 
         -Alan Coopersmith-                 alan.coopersmith@...cle.com
          Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.