Confirmed as exploited
libwebp: OOB write in BuildHuffmanTable
[Google](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html) and [Mozilla](https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/) have released security advisories for RCE due to heap overflow in libwebp. Google warns the vulnerability has been exploited in the wild. libwebp needs to be updated to 1.3.2 to include a patch for "OOB write in BuildHuffmanTable".
01 / ACTION
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
02 / AFFECTED SOFTWARE
Affected packages
10 explicit affected versions
11 explicit affected versions
184 explicit affected versions
181 explicit affected versions
200 explicit affected versions
184 explicit affected versions
81 explicit affected versions
200 explicit affected versions
93 explicit affected versions
93 explicit affected versions
5 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.
In BuildHuffmanTable of huffman_utils.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.
[Google](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html) and [Mozilla](https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/) have released security advisories for RCE due to heap overflow in libwebp. Google warns the vulnerability has been exploited in the wild. libwebp needs to be updated to 1.3.2 to include a patch for "OOB write in BuildHuffmanTable".
[Google](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html) and [Mozilla](https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/) have released security advisories for RCE due to heap overflow in libwebp. Google warns the vulnerability has been exploited in the wild. libwebp needs to be updated to 1.3.2 to include a patch for "OOB write in BuildHuffmanTable".
Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.
05 / REFERENCES
Further evidence
- https://android.googlesource.com/platform/external/webp/+/aeaf7afb3fdf4f33e499f429ba1af687e0eddca0
- https://source.android.com/security/bulletin/2023-10-01
- http://www.openwall.com/lists/oss-security/2023/09/21/4
- http://www.openwall.com/lists/oss-security/2023/09/22/1
- http://www.openwall.com/lists/oss-security/2023/09/22/3
- http://www.openwall.com/lists/oss-security/2023/09/22/4
- http://www.openwall.com/lists/oss-security/2023/09/22/5
- http://www.openwall.com/lists/oss-security/2023/09/22/6
- http://www.openwall.com/lists/oss-security/2023/09/22/7
- http://www.openwall.com/lists/oss-security/2023/09/22/8
- http://www.openwall.com/lists/oss-security/2023/09/26/1
- http://www.openwall.com/lists/oss-security/2023/09/26/7
- http://www.openwall.com/lists/oss-security/2023/09/28/1
- http://www.openwall.com/lists/oss-security/2023/09/28/2
- http://www.openwall.com/lists/oss-security/2023/09/28/4
- https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
- https://blog.isosceles.com/the-webp-0day/
- https://bugzilla.suse.com/show_bug.cgi?id=1215231
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
- https://crbug.com/1479274
- https://en.bandisoft.com/honeyview/history/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4863.json
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
- https://github.com/webmproject/libwebp/releases/tag/v1.3.2
- https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
- https://news.ycombinator.com/item?id=37478403
- https://nvd.nist.gov/vuln/detail/CVE-2023-4863
- https://security-tracker.debian.org/tracker/CVE-2023-4863
- https://security.gentoo.org/glsa/202309-05
- https://security.gentoo.org/glsa/202401-10
- https://security.netapp.com/advisory/ntap-20230929-0011/
- https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
- https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
- https://www.bentley.com/advisories/be-2023-0001/
- https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4863
- https://www.debian.org/security/2023/dsa-5496
- https://www.debian.org/security/2023/dsa-5497
- https://www.debian.org/security/2023/dsa-5498
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
- https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863
- https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway
- https://blog.isosceles.com/the-webp-0day
- https://en.bandisoft.com/honeyview/history
- https://github.com/ImageMagick/ImageMagick/discussions/6664
- https://github.com/dlemstra/Magick.NET/releases/tag/13.3.0
- https://github.com/electron/electron/pull/39823
- https://github.com/electron/electron/pull/39825
- https://github.com/electron/electron/pull/39826
- https://github.com/electron/electron/pull/39827
- https://github.com/electron/electron/pull/39828
- https://github.com/jaredforth/webp/commit/9d4c56e63abecc777df71c702503c3eaabd7dcbc
- https://github.com/jaredforth/webp/pull/30
- https://github.com/python-pillow/Pillow/pull/7395
- https://github.com/qnighy/libwebp-sys2-rs/commit/4560c473a76ec8bd8c650f19ddf9d7a44f719f8b
- https://github.com/qnighy/libwebp-sys2-rs/pull/21
- https://github.com/webmproject/libwebp
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3
- https://lists.fedoraproject.org/archives/list/[email protected]/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I
- https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html#security
- https://rustsec.org/advisories/RUSTSEC-2023-0060.html
- https://rustsec.org/advisories/RUSTSEC-2023-0061.html
- https://security.netapp.com/advisory/ntap-20230929-0011
- https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863
- https://www.bentley.com/advisories/be-2023-0001
- https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-40
- https://crates.io/crates/libwebp-sys
- https://crates.io/crates/libwebp-sys2
- https://github.com/advisories/GHSA-j7hp-h8jx-5ppr
- https://pypi.org/project/pillow