GitHub Advisoryadvisory · npm

GHSA-qqvq-6xgj-jw8g Electron affected by libvpx's heap buffer overflow in vp8 encoding

HIGH Published 2023-09-28 Modified 2024-02-15 Official page ↗
Aliases
CVE-2023-5217
Ecosystem
npm
Packages
electron
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-787
Reviewed
2023-10-05

Affected packages

• npm electron: < 22.3.25 → fixed in 22.3.25 • npm electron: >= 24.0.0, < 24.8.5 → fixed in 24.8.5 • npm electron: >= 25.0.0, < 25.8.4 → fixed in 25.8.4 • npm electron: >= 26.0.0, < 26.2.4 → fixed in 26.2.4 • npm electron: >= 27.0.0-alpha.1, < 27.0.0-beta.8 → fixed in 27.0.0-beta.8

Description

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Related

Alias · CVE (1)

  • CVE-2023-5217 Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to… vulnerability

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References