2024-04-13
ALT-BU-2024-6450-3
Branch c10f1 update bulletin.
Package lightdm-kde-greeter updated to version 0.4.18-alt1 for branch c10f1 in task 342467.
Closed bugs
Не запоминается логин последнего доменного пользователя
НЕ отображаются всплывающие подсказки для смены языка и выбора сеанса
Виртуальная клавиатура пропадает после ввода 1 символа, ввести пароль невозможно при подключении к сети через виджет на экране входа
В случае длинного имени пользователя или пароля буквы наползают на значок "виртуальная клавиатура"
[usability] Настроенная на экране входа сеть недоступна после входа в систему
[usability] Отсутствует пользовательское сообщение при вводе некорректного пароля для подключения к сети
Не осуществляется подключение ко второй сети
guest отображается со звездочкой на экране входа
Некорректное сообщение "Неверный пароль, повторите попытку" в случае, если срок действия аккаунта истек или аккаунт заблокирован
Не выполняется автологин
Некорректное отображение темы Классическая при подключенном втором мониторе
Некорректная работа всех элементов навигации в Классической теме при подключенном втором мониторе
Не запускает сессию wayland при автологине, если при установке создать пользователя с опцией "Автоматический вход в систему"
Не работает двухфакторная аутентификация
Неверно показывает поля входа после нажатия кнопки Войти другим пользователем
Стандартная иконка аватара пользователя LightDM (черный на сером)
При вводе пароля wifi не работает показ
Closed vulnerabilities
Published: 2024-02-25
Modified: 2025-05-05
Modified: 2025-05-05
BDU:2024-01535
Уязвимость компонента log_blackbox.c библиотеки libqb, позволяющая нарушителю выполнить произвольный код
Severity: CRITICAL (9.8)Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL (10.0)Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2023-08-08
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-39976
log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.
Severity: CRITICAL (9.8)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- https://github.com/ClusterLabs/libqb/commit/1bbaa929b77113532785c408dd1b41cd0521ffc8
- https://github.com/ClusterLabs/libqb/compare/v2.0.7...v2.0.8
- https://github.com/ClusterLabs/libqb/pull/490
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KECNF7LFBPE57XSBT6EM7ACVMIBP63WH/
- https://github.com/ClusterLabs/libqb/commit/1bbaa929b77113532785c408dd1b41cd0521ffc8
- https://github.com/ClusterLabs/libqb/compare/v2.0.7...v2.0.8
- https://github.com/ClusterLabs/libqb/pull/490
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KECNF7LFBPE57XSBT6EM7ACVMIBP63WH/
Closed vulnerabilities
Published: 2024-01-31
Modified: 2024-11-05
Modified: 2024-11-05
BDU:2024-00853
Уязвимость службы управления сетевыми соединениями и разрешениями доменных имён (DNS) systemd-resolved, связанная с доступом к каналу из точки, не являющейся конечной, позволяющая нарушителю изменить записи DNS, защищенные DNSSEC
Severity: MEDIUM (5.9)Vector: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity: MEDIUM (5.4)Vector: AV:N/AC:H/Au:N/C:N/I:C/A:N
References:
Published: 2023-12-23
Modified: 2025-11-04
Modified: 2025-11-04
CVE-2023-7008
A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.
Severity: MEDIUM (5.9)Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
References:
- https://access.redhat.com/errata/RHSA-2024:2463
- https://access.redhat.com/errata/RHSA-2024:3203
- https://access.redhat.com/security/cve/CVE-2023-7008
- https://bugzilla.redhat.com/show_bug.cgi?id=2222261
- https://bugzilla.redhat.com/show_bug.cgi?id=2222672
- https://github.com/systemd/systemd/issues/25676
- https://access.redhat.com/errata/RHSA-2024:2463
- https://access.redhat.com/errata/RHSA-2024:3203
- https://access.redhat.com/security/cve/CVE-2023-7008
- https://bugzilla.redhat.com/show_bug.cgi?id=2222261
- https://bugzilla.redhat.com/show_bug.cgi?id=2222672
- https://github.com/systemd/systemd/issues/25676
- https://lists.debian.org/debian-lts-announce/2024/09/msg00001.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GMDEG5PKONWNHOEYSUDRT6JEOISRMN2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QHNBXGKJWISJETTTDTZKTBFIBJUOSLKL/
- https://security.netapp.com/advisory/ntap-20241122-0004/
Package yandex-browser-stable updated to version 24.1.3.845-alt1 for branch c10f1 in task 344649.
Closed vulnerabilities
Published: 2023-09-13
Modified: 2025-09-05
Modified: 2025-09-05
BDU:2023-05510
Уязвимость библиотеки libwebp для кодирования и декодирования изображений в формате WebP, связанная с чтением за границами буфера в памяти, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: CRITICAL (10.0)Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2023-09-25
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06027
Уязвимость пользовательских вкладок браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Severity: MEDIUM (4.3)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
Published: 2023-09-26
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06106
Уязвимость компонента Prompts браузера Google Chrome, позволяющая нарушителю проводить спуфинг-атаки
Severity: MEDIUM (4.3)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
Published: 2023-09-26
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06107
Уязвимость компонента Input браузера Google Chrome, позволяющая нарушителю подменить пользовательский интерфейс
Severity: MEDIUM (4.3)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
Published: 2023-09-26
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06108
Уязвимость пользовательских вкладок браузера Google Chrome, позволяющая нарушителю подменить пользовательский интерфейс
Severity: MEDIUM (4.3)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
Published: 2023-09-28
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06132
Уязвимость компонента Prompts браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Severity: MEDIUM (4.3)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
Published: 2023-09-28
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06133
Уязвимость компонента Downloads браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Severity: MEDIUM (4.3)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
Published: 2023-09-28
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06134
Уязвимость функции автозаполнения Autofill браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Severity: MEDIUM (4.3)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
Published: 2023-09-28
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06135
Уязвимость компонента Intents браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Severity: MEDIUM (4.3)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
Published: 2023-09-28
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06136
Уязвимость технологии Picture In Picture браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Severity: MEDIUM (4.3)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
Published: 2023-09-28
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06137
Уязвимость компонента Interstitials браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Severity: MEDIUM (4.3)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
Published: 2023-09-29
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06157
Уязвимость функции кодирования в формат VP8 библиотеки libvpx браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
Severity: CRITICAL (9.6)Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Severity: CRITICAL (10.0)Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2023-10-04
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06298
Уязвимость компонента Passwords (управление паролями) браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: CRITICAL (10.0)Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2023-10-04
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06299
Уязвимость компонента Extensions (Расширения) браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: CRITICAL (10.0)Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2023-10-05
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06341
Уязвимость обработчика JavaScript-сценариев V8 браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: CRITICAL (10.0)Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2023-10-13
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06604
Уязвимость компонента Site Isolation браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: CRITICAL (10.0)Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2023-10-13
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06605
Уязвимость функции автозаполнения Autofill браузера Google Chrome, позволяющая нарушителю раскрыть защищаемую информацию
Severity: MEDIUM (6.5)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Severity: HIGH (7.8)Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N
References:
Published: 2023-10-13
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06606
Уязвимость компонента Navigation браузера Google Chrome, позволяющая нарушителю проводить спуфинг-атаки
Severity: MEDIUM (6.5)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Severity: HIGH (7.8)Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N
References:
Published: 2023-10-13
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06607
Уязвимость компонента Installer браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Severity: MEDIUM (4.3)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
Published: 2023-10-13
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06608
Уязвимость компонента Input браузера Google Chrome, позволяющая нарушителю проводить спуфинг-атаки
Severity: MEDIUM (4.3)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
Published: 2023-10-13
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06611
Уязвимость компонента Cast браузера Google Chrome, позволяющая нарушителю скомпрометировать процесс рендеринга
Severity: MEDIUM (6.3)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Severity: HIGH (7.5)Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
References:
Published: 2023-10-14
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06669
Уязвимость функции автозаполнения Autofill браузера Google Chrome, позволяющая нарушителю оказать влияние на целостность защищаемой информации
Severity: MEDIUM (4.3)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
Published: 2023-10-14
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06670
Уязвимость компонента Downloads (Загрузки) браузера Google Chrome, позволяющая нарушителю проводить спуфинг атаки
Severity: MEDIUM (6.5)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Severity: HIGH (7.8)Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N
References:
Published: 2023-10-14
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06671
Уязвимость реализации полноэкранного режима браузера Google Chrome, позволяющая нарушителю оказать влияние на целостность защищаемой информации
Severity: MEDIUM (6.5)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Severity: HIGH (7.8)Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N
References:
Published: 2023-10-17
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06780
Уязвимость компонента PDFium браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: CRITICAL (10.0)Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2023-10-17
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06823
Уязвимость компонента Blink History браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: CRITICAL (10.0)Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2023-10-17
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06824
Уязвимость набора инструментов для веб-разработки DevTools браузеров Microsoft Edge и Google Chrome, позволяющая нарушителю выполнить произвольный код
Severity: MEDIUM (6.5)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Severity: HIGH (7.8)Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N
References:
Published: 2023-10-17
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06825
Уязвимость компонента Extensions API браузеров Microsoft Edge и Google Chrome, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Severity: MEDIUM (6.5)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Severity: HIGH (7.8)Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N
References:
Published: 2023-10-17
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-06826
Уязвимость функции Intents браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения доступа
Severity: MEDIUM (6.5)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Severity: HIGH (7.8)Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N
References:
Published: 2023-10-30
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2023-07287
Уязвимость компонента Profiles браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
Severity: HIGH (8.8)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: CRITICAL (10.0)Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2024-01-17
Modified: 2024-09-12
Modified: 2024-09-12
BDU:2024-00348
Уязвимость компонента Extensions (Расширения) браузера Google Chrome, позволяющая нарушителю установить вредоносное расширение и получить доступ на чтение файлов
Severity: MEDIUM (6.3)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Severity: HIGH (7.5)Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
References:
Published: 2024-01-22
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2024-00490
Уязвимость обработчика JavaScript-сценариев V8 браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
Severity: HIGH (8.8)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: CRITICAL (10.0)Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2024-01-22
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2024-00491
Уязвимость обработчика JavaScript-сценариев V8 браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
Severity: HIGH (8.8)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: CRITICAL (10.0)Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2024-01-22
Modified: 2026-03-04
Modified: 2026-03-04
BDU:2024-00492
Уязвимость обработчика JavaScript-сценариев V8 браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
Severity: HIGH (8.8)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: CRITICAL (10.0)Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2023-09-12
Modified: 2025-10-24
Modified: 2025-10-24
CVE-2023-4863
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- http://www.openwall.com/lists/oss-security/2023/09/21/4
- http://www.openwall.com/lists/oss-security/2023/09/22/1
- http://www.openwall.com/lists/oss-security/2023/09/22/3
- http://www.openwall.com/lists/oss-security/2023/09/22/4
- http://www.openwall.com/lists/oss-security/2023/09/22/5
- http://www.openwall.com/lists/oss-security/2023/09/22/6
- http://www.openwall.com/lists/oss-security/2023/09/22/7
- http://www.openwall.com/lists/oss-security/2023/09/22/8
- http://www.openwall.com/lists/oss-security/2023/09/26/1
- http://www.openwall.com/lists/oss-security/2023/09/26/7
- http://www.openwall.com/lists/oss-security/2023/09/28/1
- http://www.openwall.com/lists/oss-security/2023/09/28/2
- http://www.openwall.com/lists/oss-security/2023/09/28/4
- https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
- https://blog.isosceles.com/the-webp-0day/
- https://bugzilla.suse.com/show_bug.cgi?id=1215231
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
- https://crbug.com/1479274
- https://en.bandisoft.com/honeyview/history/
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
- https://github.com/webmproject/libwebp/releases/tag/v1.3.2
- https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
- https://news.ycombinator.com/item?id=37478403
- https://security-tracker.debian.org/tracker/CVE-2023-4863
- https://security.gentoo.org/glsa/202309-05
- https://security.gentoo.org/glsa/202401-10
- https://security.netapp.com/advisory/ntap-20230929-0011/
- https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
- https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
- https://www.bentley.com/advisories/be-2023-0001/
- https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/
- https://www.debian.org/security/2023/dsa-5496
- https://www.debian.org/security/2023/dsa-5497
- https://www.debian.org/security/2023/dsa-5498
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
- http://www.openwall.com/lists/oss-security/2023/09/21/4
- http://www.openwall.com/lists/oss-security/2023/09/22/1
- http://www.openwall.com/lists/oss-security/2023/09/22/3
- http://www.openwall.com/lists/oss-security/2023/09/22/4
- http://www.openwall.com/lists/oss-security/2023/09/22/5
- http://www.openwall.com/lists/oss-security/2023/09/22/6
- http://www.openwall.com/lists/oss-security/2023/09/22/7
- http://www.openwall.com/lists/oss-security/2023/09/22/8
- http://www.openwall.com/lists/oss-security/2023/09/26/1
- http://www.openwall.com/lists/oss-security/2023/09/26/7
- http://www.openwall.com/lists/oss-security/2023/09/28/1
- http://www.openwall.com/lists/oss-security/2023/09/28/2
- http://www.openwall.com/lists/oss-security/2023/09/28/4
- https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
- https://blog.isosceles.com/the-webp-0day/
- https://bugzilla.suse.com/show_bug.cgi?id=1215231
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
- https://crbug.com/1479274
- https://en.bandisoft.com/honeyview/history/
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
- https://github.com/webmproject/libwebp/releases/tag/v1.3.2
- https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
- https://news.ycombinator.com/item?id=37478403
- https://security-tracker.debian.org/tracker/CVE-2023-4863
- https://security.gentoo.org/glsa/202309-05
- https://security.gentoo.org/glsa/202401-10
- https://security.netapp.com/advisory/ntap-20230929-0011/
- https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
- https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
- https://www.bentley.com/advisories/be-2023-0001/
- https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/
- https://www.debian.org/security/2023/dsa-5496
- https://www.debian.org/security/2023/dsa-5497
- https://www.debian.org/security/2023/dsa-5498
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
- https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4863
Published: 2023-09-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4900
Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate a permission prompt via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (4.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1430867
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1430867
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4901
Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (4.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1459281
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1459281
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4902
Inappropriate implementation in Input in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (4.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1454515
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1454515
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4903
Inappropriate implementation in Custom Mobile Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (4.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1446709
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1446709
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4904
Insufficient policy enforcement in Downloads in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Enterprise policy restrictions via a crafted download. (Chromium security severity: Medium)
Severity: MEDIUM (4.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1453501
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1453501
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4905
Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (4.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1441228
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1441228
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4906
Insufficient policy enforcement in Autofill in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low)
Severity: MEDIUM (4.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1449874
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1449874
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4907
Inappropriate implementation in Intents in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)
Severity: MEDIUM (4.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1462104
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1462104
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4908
Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low)
Severity: MEDIUM (4.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1451543
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1451543
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4909
Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)
Severity: MEDIUM (4.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1463293
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1463293
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-28
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5186
Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: High)
Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- https://crbug.com/1478889
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5508
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- https://crbug.com/1478889
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5508
Published: 2023-09-28
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5187
Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- https://crbug.com/1475798
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5508
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- https://crbug.com/1475798
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5508
Published: 2023-09-28
Modified: 2025-10-24
Modified: 2025-10-24
CVE-2023-5217
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- http://seclists.org/fulldisclosure/2023/Oct/12
- http://seclists.org/fulldisclosure/2023/Oct/16
- http://www.openwall.com/lists/oss-security/2023/09/28/5
- http://www.openwall.com/lists/oss-security/2023/09/28/6
- http://www.openwall.com/lists/oss-security/2023/09/29/1
- http://www.openwall.com/lists/oss-security/2023/09/29/11
- http://www.openwall.com/lists/oss-security/2023/09/29/12
- http://www.openwall.com/lists/oss-security/2023/09/29/14
- http://www.openwall.com/lists/oss-security/2023/09/29/2
- http://www.openwall.com/lists/oss-security/2023/09/29/7
- http://www.openwall.com/lists/oss-security/2023/09/29/9
- http://www.openwall.com/lists/oss-security/2023/09/30/1
- http://www.openwall.com/lists/oss-security/2023/09/30/2
- http://www.openwall.com/lists/oss-security/2023/09/30/3
- http://www.openwall.com/lists/oss-security/2023/09/30/4
- http://www.openwall.com/lists/oss-security/2023/09/30/5
- http://www.openwall.com/lists/oss-security/2023/10/01/1
- http://www.openwall.com/lists/oss-security/2023/10/01/2
- http://www.openwall.com/lists/oss-security/2023/10/01/5
- http://www.openwall.com/lists/oss-security/2023/10/02/6
- http://www.openwall.com/lists/oss-security/2023/10/03/11
- https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/
- https://bugzilla.redhat.com/show_bug.cgi?id=2241191
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- https://crbug.com/1486441
- https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
- https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282
- https://github.com/webmproject/libvpx/releases/tag/v1.13.1
- https://github.com/webmproject/libvpx/tags
- https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://pastebin.com/TdkC4pDv
- https://security-tracker.debian.org/tracker/CVE-2023-5217
- https://security.gentoo.org/glsa/202310-04
- https://security.gentoo.org/glsa/202401-34
- https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/
- https://support.apple.com/kb/HT213961
- https://support.apple.com/kb/HT213972
- https://twitter.com/maddiestone/status/1707163313711497266
- https://www.debian.org/security/2023/dsa-5508
- https://www.debian.org/security/2023/dsa-5509
- https://www.debian.org/security/2023/dsa-5510
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/
- https://www.openwall.com/lists/oss-security/2023/09/28/5
- http://seclists.org/fulldisclosure/2023/Oct/12
- http://seclists.org/fulldisclosure/2023/Oct/16
- http://www.openwall.com/lists/oss-security/2023/09/28/5
- http://www.openwall.com/lists/oss-security/2023/09/28/6
- http://www.openwall.com/lists/oss-security/2023/09/29/1
- http://www.openwall.com/lists/oss-security/2023/09/29/11
- http://www.openwall.com/lists/oss-security/2023/09/29/12
- http://www.openwall.com/lists/oss-security/2023/09/29/14
- http://www.openwall.com/lists/oss-security/2023/09/29/2
- http://www.openwall.com/lists/oss-security/2023/09/29/7
- http://www.openwall.com/lists/oss-security/2023/09/29/9
- http://www.openwall.com/lists/oss-security/2023/09/30/1
- http://www.openwall.com/lists/oss-security/2023/09/30/2
- http://www.openwall.com/lists/oss-security/2023/09/30/3
- http://www.openwall.com/lists/oss-security/2023/09/30/4
- http://www.openwall.com/lists/oss-security/2023/09/30/5
- http://www.openwall.com/lists/oss-security/2023/10/01/1
- http://www.openwall.com/lists/oss-security/2023/10/01/2
- http://www.openwall.com/lists/oss-security/2023/10/01/5
- http://www.openwall.com/lists/oss-security/2023/10/02/6
- http://www.openwall.com/lists/oss-security/2023/10/03/11
- https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/
- https://bugzilla.redhat.com/show_bug.cgi?id=2241191
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- https://crbug.com/1486441
- https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
- https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282
- https://github.com/webmproject/libvpx/releases/tag/v1.13.1
- https://github.com/webmproject/libvpx/tags
- https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://pastebin.com/TdkC4pDv
- https://security-tracker.debian.org/tracker/CVE-2023-5217
- https://security.gentoo.org/glsa/202310-04
- https://security.gentoo.org/glsa/202401-34
- https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/
- https://support.apple.com/kb/HT213961
- https://support.apple.com/kb/HT213972
- https://twitter.com/maddiestone/status/1707163313711497266
- https://www.debian.org/security/2023/dsa-5508
- https://www.debian.org/security/2023/dsa-5509
- https://www.debian.org/security/2023/dsa-5510
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/
- https://www.openwall.com/lists/oss-security/2023/09/28/5
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5217
Published: 2023-10-11
Modified: 2025-04-30
Modified: 2025-04-30
CVE-2023-5218
Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1487110
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1487110
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-05
Modified: 2025-05-01
Modified: 2025-05-01
CVE-2023-5346
Type confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop.html
- https://crbug.com/1485829
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BMFDRMWMT6ZBLGLLWSWHHRAUBOSUXQDR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RA6HMWNOYQ56R35MHW77GVW7373Z4RSN/
- https://security.gentoo.org/glsa/202401-34
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop.html
- https://crbug.com/1485829
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BMFDRMWMT6ZBLGLLWSWHHRAUBOSUXQDR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RA6HMWNOYQ56R35MHW77GVW7373Z4RSN/
- https://security.gentoo.org/glsa/202401-34
Published: 2023-10-25
Modified: 2025-05-01
Modified: 2025-05-01
CVE-2023-5472
Use after free in Profiles in Google Chrome prior to 118.0.5993.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_24.html
- https://crbug.com/1491296
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5TWIUD4VIISLZWEQ4WLWFZT34T3KOXZB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RA6HMWNOYQ56R35MHW77GVW7373Z4RSN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDMQG42VVOZ5USSI4NSNT3VJPGBPNSIW/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5536
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_24.html
- https://crbug.com/1491296
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5TWIUD4VIISLZWEQ4WLWFZT34T3KOXZB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RA6HMWNOYQ56R35MHW77GVW7373Z4RSN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDMQG42VVOZ5USSI4NSNT3VJPGBPNSIW/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5536
Published: 2023-10-11
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5473
Use after free in Cast in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
Severity: MEDIUM (6.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1484000
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1484000
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-11
Modified: 2025-05-01
Modified: 2025-05-01
CVE-2023-5474
Heap buffer overflow in PDF in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium)
Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1483194
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1483194
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-11
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5475
Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. (Chromium security severity: Medium)
Severity: MEDIUM (6.5)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1476952
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1476952
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-11
Modified: 2025-05-01
Modified: 2025-05-01
CVE-2023-5476
Use after free in Blink History in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1474253
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1474253
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-11
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5477
Inappropriate implementation in Installer in Google Chrome prior to 118.0.5993.70 allowed a local attacker to bypass discretionary access control via a crafted command. (Chromium security severity: Low)
Severity: MEDIUM (4.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1472558
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1472558
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-11
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5478
Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Severity: MEDIUM (4.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1472404
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1472404
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-11
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5479
Inappropriate implementation in Extensions API in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (6.5)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1471253
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1471253
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-11
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5481
Inappropriate implementation in Downloads in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (6.5)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1458934
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1458934
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-11
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5483
Inappropriate implementation in Intents in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (6.5)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1425355
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1425355
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-11
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5484
Inappropriate implementation in Navigation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (6.5)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1414936
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1414936
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-11
Modified: 2025-06-16
Modified: 2025-06-16
CVE-2023-5485
Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass autofill restrictions via a crafted HTML page. (Chromium security severity: Low)
Severity: MEDIUM (4.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1395164
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1395164
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-11
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5486
Inappropriate implementation in Input in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low)
Severity: MEDIUM (4.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1357442
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1357442
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-11
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5487
Inappropriate implementation in Fullscreen in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)
Severity: MEDIUM (6.5)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1062251
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1062251
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
Published: 2024-01-10
Modified: 2025-06-03
Modified: 2025-06-03
CVE-2024-0333
Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.216 allowed an attacker in a privileged network position to install a malicious extension via a crafted HTML page. (Chromium security severity: High)
Severity: MEDIUM (5.3)Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
- https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_9.html
- https://crbug.com/1513379
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BXC7FJIAZRY3P72XC4Z4UOW2QDA7YX7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPYCYENYQYADCOS6XG4JITUVRZ6HTE2B/
- https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_9.html
- https://crbug.com/1513379
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BXC7FJIAZRY3P72XC4Z4UOW2QDA7YX7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPYCYENYQYADCOS6XG4JITUVRZ6HTE2B/
Published: 2024-01-16
Modified: 2025-05-22
Modified: 2025-05-22
CVE-2024-0517
Out of bounds write in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html
- https://crbug.com/1515930
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIUBRVICICWREJQUVT67RS7E4PVZQ5RS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNN4SO5UI3U3Q6ASTVT6WMZ4723FYDLH/
- https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html
- https://crbug.com/1515930
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIUBRVICICWREJQUVT67RS7E4PVZQ5RS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNN4SO5UI3U3Q6ASTVT6WMZ4723FYDLH/
- https://www.vicarius.io/vsociety/posts/out-of-bound-write-in-v8-javascript-engine-cve-2024-0517
Published: 2024-01-16
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2024-0518
Type confusion in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html
- https://crbug.com/1507412
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIUBRVICICWREJQUVT67RS7E4PVZQ5RS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNN4SO5UI3U3Q6ASTVT6WMZ4723FYDLH/
- https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html
- https://crbug.com/1507412
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIUBRVICICWREJQUVT67RS7E4PVZQ5RS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNN4SO5UI3U3Q6ASTVT6WMZ4723FYDLH/
Published: 2024-01-16
Modified: 2025-10-24
Modified: 2025-10-24
CVE-2024-0519
Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html
- https://crbug.com/1517354
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIUBRVICICWREJQUVT67RS7E4PVZQ5RS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNN4SO5UI3U3Q6ASTVT6WMZ4723FYDLH/
- https://www.couchbase.com/alerts/
- https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html
- https://crbug.com/1517354
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIUBRVICICWREJQUVT67RS7E4PVZQ5RS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNN4SO5UI3U3Q6ASTVT6WMZ4723FYDLH/
- https://www.couchbase.com/alerts/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-0519
Published: 2024-08-31
GHSA-cxjf-x6jp-p7mc
opencv-contrib-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
Severity: HIGH (8.6)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH (8.6)Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-4863
- https://github.com/opencv/opencv/pull/24274
- https://github.com/opencv/opencv/commit/687fc11626901cff09d2b3b5f331fd59190ad4c7
- https://github.com/advisories/GHSA-j7hp-h8jx-5ppr
- https://github.com/opencv/opencv-python
- https://github.com/opencv/opencv/wiki/ChangeLog#version481
- https://github.com/pypa/advisory-database/tree/main/vulns/opencv-contrib-python/PYSEC-2023-181.yaml
Published: 2023-09-12
Modified: 2025-07-09
Modified: 2025-07-09
GHSA-j7hp-h8jx-5ppr
libwebp: OOB write in BuildHuffmanTable
Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-4863
- https://github.com/qnighy/libwebp-sys2-rs/pull/21
- https://github.com/python-pillow/Pillow/pull/7395
- https://github.com/jaredforth/webp/pull/30
- https://github.com/electron/electron/pull/39823
- https://github.com/electron/electron/pull/39825
- https://github.com/electron/electron/pull/39826
- https://github.com/electron/electron/pull/39827
- https://github.com/electron/electron/pull/39828
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
- https://github.com/qnighy/libwebp-sys2-rs/commit/4560c473a76ec8bd8c650f19ddf9d7a44f719f8b
- https://github.com/jaredforth/webp/commit/9d4c56e63abecc777df71c702503c3eaabd7dcbc
- https://security.gentoo.org/glsa/202401-10
- https://security.gentoo.org/glsa/202309-05
- https://security-tracker.debian.org/tracker/CVE-2023-4863
- https://rustsec.org/advisories/RUSTSEC-2023-0061.html
- https://rustsec.org/advisories/RUSTSEC-2023-0060.html
- https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html#security
- https://news.ycombinator.com/item?id=37478403
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
- https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway
- https://security.netapp.com/advisory/ntap-20230929-0011
- https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
- https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863
- https://www.bentley.com/advisories/be-2023-0001
- https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks
- https://www.debian.org/security/2023/dsa-5496
- https://www.debian.org/security/2023/dsa-5497
- https://www.debian.org/security/2023/dsa-5498
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-40
- https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863
- https://blog.isosceles.com/the-webp-0day
- https://bugzilla.suse.com/show_bug.cgi?id=1215231
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
- https://crbug.com/1479274
- https://en.bandisoft.com/honeyview/history
- https://github.com/ImageMagick/ImageMagick/discussions/6664
- https://github.com/dlemstra/Magick.NET/releases/tag/13.3.0
- https://github.com/webmproject/libwebp
- https://github.com/webmproject/libwebp/releases/tag/v1.3.2
- https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I
- http://www.openwall.com/lists/oss-security/2023/09/21/4
- http://www.openwall.com/lists/oss-security/2023/09/22/1
- http://www.openwall.com/lists/oss-security/2023/09/22/3
- http://www.openwall.com/lists/oss-security/2023/09/22/4
- http://www.openwall.com/lists/oss-security/2023/09/22/5
- http://www.openwall.com/lists/oss-security/2023/09/22/6
- http://www.openwall.com/lists/oss-security/2023/09/22/7
- http://www.openwall.com/lists/oss-security/2023/09/22/8
- http://www.openwall.com/lists/oss-security/2023/09/26/1
- http://www.openwall.com/lists/oss-security/2023/09/26/7
- http://www.openwall.com/lists/oss-security/2023/09/28/1
- http://www.openwall.com/lists/oss-security/2023/09/28/2
- http://www.openwall.com/lists/oss-security/2023/09/28/4
Published: 2024-08-31
GHSA-jh2j-j4j9-crg3
opencv-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
Severity: HIGH (8.6)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH (8.6)Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-4863
- https://github.com/opencv/opencv/pull/24274
- https://github.com/opencv/opencv/commit/687fc11626901cff09d2b3b5f331fd59190ad4c7
- https://github.com/advisories/GHSA-j7hp-h8jx-5ppr
- https://github.com/opencv/opencv-python
- https://github.com/opencv/opencv/wiki/ChangeLog#version481
- https://github.com/pypa/advisory-database/tree/main/vulns/opencv-python-headless/PYSEC-2023-184.yaml
Published: 2023-09-28
Modified: 2024-02-15
Modified: 2024-02-15
GHSA-qqvq-6xgj-jw8g
Electron affected by libvpx's heap buffer overflow in vp8 encoding
Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-5217
- https://github.com/electron/electron/pull/40022
- https://github.com/electron/electron/pull/40023
- https://github.com/electron/electron/pull/40024
- https://github.com/electron/electron/pull/40025
- https://github.com/electron/electron/pull/40026
- https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282
- https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I
- https://pastebin.com/TdkC4pDv
- https://security-tracker.debian.org/tracker/CVE-2023-5217
- https://security.gentoo.org/glsa/202310-04
- https://security.gentoo.org/glsa/202401-34
- https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217
- https://support.apple.com/kb/HT213961
- https://support.apple.com/kb/HT213972
- https://twitter.com/maddiestone/status/1707163313711497266
- https://www.debian.org/security/2023/dsa-5508
- https://www.debian.org/security/2023/dsa-5509
- https://www.debian.org/security/2023/dsa-5510
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-44
- https://www.openwall.com/lists/oss-security/2023/09/28/5
- https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software
- https://bugzilla.redhat.com/show_bug.cgi?id=2241191
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- https://crbug.com/1486441
- https://github.com/electron/electron
- https://github.com/electron/electron/releases/tag/v22.3.25
- https://github.com/electron/electron/releases/tag/v24.8.5
- https://github.com/electron/electron/releases/tag/v25.8.4
- https://github.com/electron/electron/releases/tag/v26.2.4
- https://github.com/electron/electron/releases/tag/v27.0.0-beta.8
- https://github.com/webmproject/libvpx/releases/tag/v1.13.1
- https://github.com/webmproject/libvpx/tags
- https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD
- http://seclists.org/fulldisclosure/2023/Oct/12
- http://seclists.org/fulldisclosure/2023/Oct/16
- http://www.openwall.com/lists/oss-security/2023/09/28/5
- http://www.openwall.com/lists/oss-security/2023/09/28/6
- http://www.openwall.com/lists/oss-security/2023/09/29/1
- http://www.openwall.com/lists/oss-security/2023/09/29/11
- http://www.openwall.com/lists/oss-security/2023/09/29/12
- http://www.openwall.com/lists/oss-security/2023/09/29/14
- http://www.openwall.com/lists/oss-security/2023/09/29/2
- http://www.openwall.com/lists/oss-security/2023/09/29/7
- http://www.openwall.com/lists/oss-security/2023/09/29/9
- http://www.openwall.com/lists/oss-security/2023/09/30/1
- http://www.openwall.com/lists/oss-security/2023/09/30/2
- http://www.openwall.com/lists/oss-security/2023/09/30/3
- http://www.openwall.com/lists/oss-security/2023/09/30/4
- http://www.openwall.com/lists/oss-security/2023/09/30/5
- http://www.openwall.com/lists/oss-security/2023/10/01/1
- http://www.openwall.com/lists/oss-security/2023/10/01/2
- http://www.openwall.com/lists/oss-security/2023/10/01/5
- http://www.openwall.com/lists/oss-security/2023/10/02/6
- http://www.openwall.com/lists/oss-security/2023/10/03/11
Published: 2024-08-31
Modified: 2024-08-31
Modified: 2024-08-31
GHSA-qr4w-53vh-m672
opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
Severity: HIGH (8.6)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH (8.6)Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-4863
- https://github.com/opencv/opencv/pull/24274
- https://github.com/opencv/opencv/commit/687fc11626901cff09d2b3b5f331fd59190ad4c7
- https://github.com/opencv/opencv-python
- https://github.com/opencv/opencv/wiki/ChangeLog#version481
- https://github.com/pypa/advisory-database/tree/main/vulns/opencv-python/PYSEC-2023-183.yaml
Published: 2024-08-31
GHSA-w2pj-9cgh-mq2c
opencv-contrib-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
Severity: HIGH (8.6)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH (8.6)Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-4863
- https://github.com/opencv/opencv/pull/24274
- https://github.com/opencv/opencv/commit/687fc11626901cff09d2b3b5f331fd59190ad4c7
- https://github.com/advisories/GHSA-j7hp-h8jx-5ppr
- https://github.com/opencv/opencv-python
- https://github.com/opencv/opencv/wiki/ChangeLog#version481
- https://github.com/pypa/advisory-database/tree/main/vulns/opencv-contrib-python-headless/PYSEC-2023-182.yaml
Published: 2023-10-06
GHSA-wqcr-xm43-hpqr
Vulnerable version of libwebp and can be exploited with a malicious source image
Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://github.com/imazen/resizer/security/advisories/GHSA-wqcr-xm43-hpqr
- https://nvd.nist.gov/vuln/detail/CVE-2023-4863
- https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76
- https://github.com/NoXF/libwebp-sys/commits/master
- https://github.com/advisories/GHSA-j7hp-h8jx-5ppr
- https://github.com/imazen/resizer