CVE-2023-4863
Description
Important: firefox security update
CISA KEV
- Vendor
- Product
- Chromium WebP
- Due date
- 2023-10-04
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: alma — https://errata.almalinux.org/9/ALSA-2023-5200.html
Vendor advisory: alma — https://errata.almalinux.org/9/ALSA-2023-5224.html
Vendor advisory: alma — https://errata.almalinux.org/9/ALSA-2023-5214.html
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2023-5201.html
Vendor advisory: alma — https://access.redhat.com/errata/RHSA-2023:5201
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2023-5184.html
Vendor advisory: alma — https://access.redhat.com/errata/RHSA-2023:5184
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2023-5309.html
Vendor advisory: alma — https://bugzilla.redhat.com/2238431
Vendor advisory: alma — https://access.redhat.com/errata/RHSA-2023:5309
Vendor advisory: cisa-kev — https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html?m=1; https://nvd.nist.gov/vuln/detail/CVE-2023-4863
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2023:5214
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2023-4863.html
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2023:5184
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2023:5309
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2023:5201
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2023-4863
Vendor advisory: redhat — https://access.redhat.com/errata/RHSA-2023:5224
Vendor advisory: redhat — https://access.redhat.com/errata/RHSA-2023:5214
Vendor advisory: redhat — https://access.redhat.com/errata/RHSA-2023:5200
Exploits
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rhel | 9 | fixed | |
| debian | bookworm | fixed | 117.0.5938.62-1 |
| debian | bullseye | fixed | 117.0.5938.62-1 |
| debian | forky | fixed | 117.0.5938.62-1 |
| debian | sid | fixed | 117.0.5938.62-1 |
| debian | trixie | fixed | 117.0.5938.62-1 |
| rocky | 8 | fixed | |
| sles | affected | | |
| rocky | 9 | fixed | |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| crates.io | libwebp-sys | | |
| crates.io | libwebp-sys2 | | |
| crates.io | libwebp-sys2 | <0.1.8 | 0.1.8 |
| crates.io | libwebp-sys | <0.9.3 | 0.9.3 |
| npm | electron | >=22.0.0,<22.3.24 | 22.3.24 |
| npm | electron | >=24.0.0,<24.8.3 | 24.8.3 |
| npm | electron | >=25.0.0,<25.8.1 | 25.8.1 |
| npm | electron | >=26.0.0,<26.2.1 | 26.2.1 |
| npm | electron | >=27.0.0-beta.1,<27.0.0-beta.2 | 27.0.0-beta.2 |
| NuGet | SkiaSharp | >=2.0.0,<2.88.6 | 2.88.6 |
| Go | github.com/chai2010/webp | >=1.1.2,<1.4.0 | 1.4.0 |
| PyPI | pillow | <10.0.1 | 10.0.1 |
| crates.io | webp | <0.2.6 | 0.2.6 |
| NuGet | magick.net-q16-anycpu | <13.3.0 | 13.3.0 |
| NuGet | magick.net-q16-hdri-anycpu | <13.3.0 | 13.3.0 |
| NuGet | magick.net-q16-x64 | <13.3.0 | 13.3.0 |
| NuGet | magick.net-q8-anycpu | <13.3.0 | 13.3.0 |
| NuGet | magick.net-q8-openmp-x64 | <13.3.0 | 13.3.0 |
| NuGet | magick.net-q8-x64 | <13.3.0 | 13.3.0 |
| Go | github.com/chai2010/webp | <0.0.0-20250406010349-76805d5a8860 | 0.0.0-20250406010349-76805d5a8860 |
| Go | github.com/chai2010/webp | >=0.0.0,<1.1.2-0.20250406010349-76805d5a8860 | 1.1.2-0.20250406010349-76805d5a8860 |
| crates.io | libwebp-sys | >=0.0.0-0,<0.9.3 | 0.9.3 |
| crates.io | libwebp-sys2 | >=0.0.0-0,<0.1.8 | 0.1.8 |
References
- https://access.redhat.com/errata/RHSA-2023:5200
- https://access.redhat.com/errata/RHSA-2023:5214
- https://access.redhat.com/errata/RHSA-2023:5224
- https://nvd.nist.gov/vuln/detail/CVE-2023-4863
- https://github.com/qnighy/libwebp-sys2-rs/pull/21
- https://github.com/python-pillow/Pillow/pull/7395
- https://github.com/jaredforth/webp/pull/30
- https://github.com/electron/electron/pull/39823
- https://github.com/electron/electron/pull/39825
- https://github.com/electron/electron/pull/39826
- https://github.com/electron/electron/pull/39827
- https://github.com/electron/electron/pull/39828
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
- https://github.com/qnighy/libwebp-sys2-rs/commit/4560c473a76ec8bd8c650f19ddf9d7a44f719f8b
- https://github.com/jaredforth/webp/commit/9d4c56e63abecc777df71c702503c3eaabd7dcbc
- https://security.gentoo.org/glsa/202401-10
- https://security.gentoo.org/glsa/202309-05
- https://security-tracker.debian.org/tracker/CVE-2023-4863
- https://rustsec.org/advisories/RUSTSEC-2023-0061.html
- https://rustsec.org/advisories/RUSTSEC-2023-0060.html
- https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html#security
- https://news.ycombinator.com/item?id=37478403
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
- https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway
- https://security.netapp.com/advisory/ntap-20230929-0011
Verify integrity in audit chain (admin only). AS-IS.