The vulnerability of the libwebp library lies in its ability to read images in the WebP format beyond the buffer limit in memory. This allows an attacker to execute arbitrary code.

The vulnerability of the libwebp library for encoding and decoding WebP images involves reading beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Mozilla Thunderbird < 115.2.2

The version of Thunderbird installed on the remote Windows host is prior to 115.2.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2023-40 advisory. - Opening a malicious WebP image could lead to a heap buffer overflow in the content process. We are aware of this issue...

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec...

html5-picture (>=0.0.4-alpha, <=0.2.0), image-decompose (>=0.1.0, <=0.4.1) +3 more potentially affected by CVE-2023-4863 via libwebp-sys (>=0.2.0, <=0.5.0)

libwebp-sys CARGO version =0.2.0, =0.0.4-alpha, =0.1.0, =0.5.17, =0.1.0, =0.2.2 Source cves: CVE-2023-4863 Source advisory: GHSA-J7HP-H8JX-5PPR...

html5-picture (>=0.0.4-alpha, <=0.2.0), image-decompose (>=0.1.0, <=0.4.1) +3 more potentially affected by CVE-2023-4863 +1 more via libwebp-sys (>=0.2.0, <=0.5.0)

libwebp-sys CARGO version =0.2.0, =0.0.4-alpha, =0.1.0, =0.5.17, =0.1.0, =0.2.2 Source cves: CVE-2023-4863, CVE-2023-5129 Source advisory: OSV:GHSA-J7HP-H8JX-5PPR...

html5-picture (>=0.0.4-alpha, <=0.2.0), image-decompose (>=0.1.0, <=0.4.1) +1 more potentially affected by CVE-2023-4863 +1 more via webp (0.1.3)

webp CARGO version 0.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on webp and may be impacted: - html5-picture =0.0.4-alpha, =0.1.0, =0.4.1 - towebp 0.1.0 Source cves: CVE-2023-4863, CVE-2023-5129 Source advisory: OSV:GHSA-J7HP-H8JX-5PPR...

Minor update (3) for Vivaldi Desktop Browser 6.2

Download Vivaldi The following improvements were made since the second 6.2 minor update: Chromium Upgraded to 116.0.5845.195: fixes CVE-2023-4863 a.k.a CVE-2023-5129 — Heap buffer overflow in WebP. Reported by Apple Security Engineering and Architecture SEAR and The Citizen Lab at The University ...

Chromium: CVE-2023-4863 Heap buffer overflow in WebP

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information. Google is aware that an exploit for CVE-2023-4863 exists in the wild...

Google Rushes to Patch Critical Chrome Vulnerability Exploited in the Wild - Update Now

Google on Monday rolled out out-of-band security patches to address a critical security flaw in its Chrome web browser that it said has been exploited in the wild. Tracked as CVE-2023-4863, the issue has been described as a case of heap buffer overflow that resides in the WebP image format that...

PT-2023-31783

Name of the Vulnerable Software and Affected Versions libwebp versions 0.5.0 through 1.3.1 Description A critical vulnerability has been identified in the libwebp image library, which can be exploited by a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. The...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 117 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 117.0.5938.62 Linux and Mac, 117.0.5938.62/.63 Windows contains a number of fixes and improvements -- a list of changes is...

Microsoft Edge (Chromium) < 116.0.1938.81 (CVE-2023-4863)

The version of Microsoft Edge installed on the remote Windows host is prior to 116.0.1938.81. It is, therefore, affected by a vulnerability as referenced in the September 12, 2023 advisory. - Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perfor...

Google Chrome < 117.0.5938.62 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 117.0.5938.62. It is, therefore, affected by multiple vulnerabilities as referenced in the 202309stable-channel-update-for-desktop12 advisory. - Inappropriate implementation in Interstitials in Google Chrome prior to...

graphics/webp heap buffer overflow

Google Chrome reports: Heap buffer overflow in WebP ... allowed a remote attacker to perform an out of bounds memory write...

Security Vulnerability fixed in Firefox 117.0.1, Firefox ESR 115.2.1, Firefox ESR 102.15.1, Thunderbird 102.15.1, and Thunderbird 115.2.2 — Mozilla

Opening a malicious WebP image could lead to a heap buffer overflow in the content process. We are aware of this issue being exploited in other products in the wild. Note: This advisory was previously also tracked as CVE-2023-5129...

KLA60566 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, obtain sensitive information, bypass security restrictions, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A denial of...

Heap-based Buffer Overflow

Overview Magick.NET.Core is a .NET library for ImageMagick Affected versions of this package are vulnerable to Heap-based Buffer Overflow when the ReadHuffmanCodes function is used. An attacker can craft a special WebP lossless file that triggers the ReadHuffmanCodes function to allocate the...

Heap-based Buffer Overflow

Overview ImageResizer.Plugins.FreeImage is an ImageResizer.Plugins.FreeImage contains several plugins, all based around the abilities offered by the C/C++ FreeImage library. These plugins are alpha-level. Affected versions of this package are vulnerable to Heap-based Buffer Overflow when the...

Heap-based Buffer Overflow

Overview CefSharp.Common is a the CefSharp Chromium-based browser component 'Core' and common 'Element' components, needed by both WPF and WinForms. Affected versions of this package are vulnerable to Heap-based Buffer Overflow when the ReadHuffmanCodes function is used. An attacker can craft a...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow when the ReadHuffmanCodes function is used. An attacker can craft a special WebP lossless file that triggers the ReadHuffmanCodes function to allocate the HuffmanCode buffer with a size that comes from an arra...