NVD脆弱性詳細

CVE-2023-5217

概要	Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
公表日	2023年9月29日1:15
登録日	2023年9月29日10:00
最終更新日	2024年11月21日17:41

CVSS3.1 : HIGH
スコア	8.8
ベクター	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

影響を受けるソフトウェアの構成

構成1		以上	以下	より上	未満
cpe:2.3:a:webmproject:libvpx::::::::					1.13.1
実行環境
1	cpe:2.3:a:google:chrome::::::::
2	cpe:2.3:a:mozilla:firefox::::::::
3	cpe:2.3:a:mozilla:firefox::::::android::*
4	cpe:2.3:a:mozilla:firefox_esr::::::::
5	cpe:2.3:a:mozilla:firefox_focus::::::android::*

構成2	以上	以下	より上	未満
cpe:2.3:a:microsoft:edge:116.0.1938.98:::::::*
cpe:2.3:a:microsoft:edge:117.0.2045.47:::::::*
cpe:2.3:a:microsoft:edge_chromium:116.0.5845.229:::::::*
cpe:2.3:a:microsoft:edge_chromium:117.0.5938.132:::::::*

構成3	以上	以下	より上	未満
cpe:2.3:a:mozilla:firefox_focus::::::android::*				118.1
cpe:2.3:a:mozilla:firefox_esr::::::::				115.3.1
cpe:2.3:a:mozilla:firefox::::::android::*				118.1
cpe:2.3:a:mozilla:firefox::::::::				118.0.1
cpe:2.3:a:mozilla:thunderbird::::::::				115.3.1

構成4	以上	以下	より上	未満
cpe:2.3:o:fedoraproject:fedora:37:::::::*
cpe:2.3:o:fedoraproject:fedora:38:::::::*
cpe:2.3:o:fedoraproject:fedora:39:::::::*

構成5	以上	以下	より上	未満
cpe:2.3:o:debian:debian_linux:10.0:::::::*
cpe:2.3:o:debian:debian_linux:11.0:::::::*
cpe:2.3:o:debian:debian_linux:12.0:::::::*

構成6	以上	以下	より上	未満
cpe:2.3:o:apple:iphone_os::::::::	17.0			17.0.3
cpe:2.3:o:apple:ipad_os::::::::	17.0			17.0.3
cpe:2.3:o:apple:ipad_os:16.7:::::::*
cpe:2.3:o:apple:iphone_os:16.7:::::::*

関連情報、対策とツール

No	URL	タグ
1	http://seclists.org/fulldisclosure/2023/Oct/12	Mailing List Third Party Advisory
2	http://seclists.org/fulldisclosure/2023/Oct/12	Mailing List Third Party Advisory
3	http://seclists.org/fulldisclosure/2023/Oct/16	Mailing List Third Party Advisory
4	http://seclists.org/fulldisclosure/2023/Oct/16	Mailing List Third Party Advisory
5	http://www.openwall.com/lists/oss-security/2023/09/28/5	Mailing List Patch Third Party Advisory
6	http://www.openwall.com/lists/oss-security/2023/09/28/5	Mailing List Patch Third Party Advisory
7	http://www.openwall.com/lists/oss-security/2023/09/28/6	Mailing List Patch Third Party Advisory
8	http://www.openwall.com/lists/oss-security/2023/09/28/6	Mailing List Patch Third Party Advisory
9	http://www.openwall.com/lists/oss-security/2023/09/29/1	Mailing List Third Party Advisory
10	http://www.openwall.com/lists/oss-security/2023/09/29/1	Mailing List Third Party Advisory
11	http://www.openwall.com/lists/oss-security/2023/09/29/11	Mailing List Third Party Advisory
12	http://www.openwall.com/lists/oss-security/2023/09/29/11	Mailing List Third Party Advisory
13	http://www.openwall.com/lists/oss-security/2023/09/29/12	Mailing List Third Party Advisory
14	http://www.openwall.com/lists/oss-security/2023/09/29/12	Mailing List Third Party Advisory
15	http://www.openwall.com/lists/oss-security/2023/09/29/14	Mailing List Third Party Advisory
16	http://www.openwall.com/lists/oss-security/2023/09/29/14	Mailing List Third Party Advisory
17	http://www.openwall.com/lists/oss-security/2023/09/29/2	Mailing List Third Party Advisory
18	http://www.openwall.com/lists/oss-security/2023/09/29/2	Mailing List Third Party Advisory
19	http://www.openwall.com/lists/oss-security/2023/09/29/7	Mailing List Third Party Advisory
20	http://www.openwall.com/lists/oss-security/2023/09/29/7	Mailing List Third Party Advisory
21	http://www.openwall.com/lists/oss-security/2023/09/29/9	Mailing List Third Party Advisory
22	http://www.openwall.com/lists/oss-security/2023/09/29/9	Mailing List Third Party Advisory
23	http://www.openwall.com/lists/oss-security/2023/09/30/1	Mailing List Third Party Advisory
24	http://www.openwall.com/lists/oss-security/2023/09/30/1	Mailing List Third Party Advisory
25	http://www.openwall.com/lists/oss-security/2023/09/30/2	Mailing List Third Party Advisory
26	http://www.openwall.com/lists/oss-security/2023/09/30/2	Mailing List Third Party Advisory
27	http://www.openwall.com/lists/oss-security/2023/09/30/3	Mailing List Third Party Advisory
28	http://www.openwall.com/lists/oss-security/2023/09/30/3	Mailing List Third Party Advisory
29	http://www.openwall.com/lists/oss-security/2023/09/30/4	Mailing List Third Party Advisory
30	http://www.openwall.com/lists/oss-security/2023/09/30/4	Mailing List Third Party Advisory
31	http://www.openwall.com/lists/oss-security/2023/09/30/5	Mailing List Third Party Advisory
32	http://www.openwall.com/lists/oss-security/2023/09/30/5	Mailing List Third Party Advisory
33	http://www.openwall.com/lists/oss-security/2023/10/01/1	Mailing List Third Party Advisory
34	http://www.openwall.com/lists/oss-security/2023/10/01/1	Mailing List Third Party Advisory
35	http://www.openwall.com/lists/oss-security/2023/10/01/2	Mailing List Third Party Advisory
36	http://www.openwall.com/lists/oss-security/2023/10/01/2	Mailing List Third Party Advisory
37	http://www.openwall.com/lists/oss-security/2023/10/01/5	Mailing List Third Party Advisory
38	http://www.openwall.com/lists/oss-security/2023/10/01/5	Mailing List Third Party Advisory
39	http://www.openwall.com/lists/oss-security/2023/10/02/6	Mailing List Third Party Advisory
40	http://www.openwall.com/lists/oss-security/2023/10/02/6	Mailing List Third Party Advisory
41	http://www.openwall.com/lists/oss-security/2023/10/03/11	Mailing List Third Party Advisory
42	http://www.openwall.com/lists/oss-security/2023/10/03/11	Mailing List Third Party Advisory
43	https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/	Third Party Advisory
44	https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/	Third Party Advisory
45	https://bugzilla.redhat.com/show_bug.cgi?id=2241191	Issue Tracking Third Party Advisory
46	https://bugzilla.redhat.com/show_bug.cgi?id=2241191	Issue Tracking Third Party Advisory
47	https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html	Release Notes Vendor Advisory
48	https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html	Release Notes Vendor Advisory
49	https://crbug.com/1486441	Issue Tracking Permissions Required
50	https://crbug.com/1486441	Issue Tracking Permissions Required
51	https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590	Patch
52	https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590	Patch
53	https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282	Patch
54	https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282	Patch
55	https://github.com/webmproject/libvpx/releases/tag/v1.13.1	Release Notes
56	https://github.com/webmproject/libvpx/releases/tag/v1.13.1	Release Notes
57	https://github.com/webmproject/libvpx/tags	Product
58	https://github.com/webmproject/libvpx/tags	Product
59	https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html	Mailing List
60	https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html	Mailing List
61	https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html	Mailing List
62	https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html	Mailing List
63	https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html	Mailing List
64	https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html	Mailing List
65	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/	Mailing List
66	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/	Mailing List
67	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/	Mailing List
68	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/	Mailing List
69	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/	Mailing List
70	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/	Mailing List
71	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/	Mailing List
72	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/	Mailing List
73	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/	Mailing List
74	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/	Mailing List
75	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/	Mailing List
76	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/	Mailing List
77	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/	Mailing List
78	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/	Mailing List
79	https://pastebin.com/TdkC4pDv	Not Applicable
80	https://pastebin.com/TdkC4pDv	Not Applicable
81	https://security.gentoo.org/glsa/202310-04	Third Party Advisory
82	https://security.gentoo.org/glsa/202310-04	Third Party Advisory
83	https://security.gentoo.org/glsa/202401-34	Third Party Advisory
84	https://security.gentoo.org/glsa/202401-34	Third Party Advisory
85	https://security-tracker.debian.org/tracker/CVE-2023-5217	Patch Third Party Advisory
86	https://security-tracker.debian.org/tracker/CVE-2023-5217	Patch Third Party Advisory
87	https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/	Third Party Advisory
88	https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/	Third Party Advisory
89	https://support.apple.com/kb/HT213961	Third Party Advisory
90	https://support.apple.com/kb/HT213961	Third Party Advisory
91	https://support.apple.com/kb/HT213972	Third Party Advisory
92	https://support.apple.com/kb/HT213972	Third Party Advisory
93	https://twitter.com/maddiestone/status/1707163313711497266	Third Party Advisory
94	https://twitter.com/maddiestone/status/1707163313711497266	Third Party Advisory
95	https://www.debian.org/security/2023/dsa-5508	Third Party Advisory
96	https://www.debian.org/security/2023/dsa-5508	Third Party Advisory
97	https://www.debian.org/security/2023/dsa-5509	Third Party Advisory
98	https://www.debian.org/security/2023/dsa-5509	Third Party Advisory
99	https://www.debian.org/security/2023/dsa-5510	Third Party Advisory
100	https://www.debian.org/security/2023/dsa-5510	Third Party Advisory
101	https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/	Third Party Advisory
102	https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/	Third Party Advisory
103	https://www.openwall.com/lists/oss-security/2023/09/28/5	Mailing List Third Party Advisory
104	https://www.openwall.com/lists/oss-security/2023/09/28/5	Mailing List Third Party Advisory

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-787	境界外書き込み	https://cwe.mitre.org/data/definitions/787.html

JVN脆弱性情報

WebM Project の libvpx における境界外書き込みに関する脆弱性

タイトル	WebM Project の libvpx における境界外書き込みに関する脆弱性
概要	WebM Project の libvpx には、境界外書き込みに関する脆弱性が存在します。
想定される影響	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
対策	ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。
公表日	2023年9月28日0:00
登録日	2023年10月10日15:23
最終更新日	2025年7月24日14:22

影響を受けるシステム

WebM Project

libvpx 1.13.1

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
CISA Known Exploited Vulnerabilities Catalog
1	CVE-2023-5217	https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Common Vulnerabilities and Exposures (CVE)
2	CVE-2023-5217	https://www.cve.org/CVERecord?id=CVE-2023-5217
National Vulnerability Database (NVD)
3	CVE-2023-5217	https://nvd.nist.gov/vuln/detail/CVE-2023-5217

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-787	https://cwe.mitre.org/data/definitions/787.html

その他

No	名前	URL
ICS-CERT ADVISORY
1	ICSA-25-203-04	https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-04
JVN
2	JVNVU#99891704	https://jvn.jp/vu/JVNVU99891704/index.html
関連文書
3	arstechnica.com (new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software)	https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/
4	bugzilla.redhat.com (2241191)	https://bugzilla.redhat.com/show_bug.cgi?id=2241191
5	chromereleases.googleblog.com (stable-channel-update-for-desktop_27)	https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
6	github.com (3fbd1dca6a4d2dad332a2110d646e4ffef36d590)	https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
7	github.com (af6dedd715f4307669366944cca6e0417b290282)	https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282
8	github.com (tags)	https://github.com/webmproject/libvpx/tags
9	github.com (v1.13.1)	https://github.com/webmproject/libvpx/releases/tag/v1.13.1
10	lists.debian.org (msg00001)	https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html
11	lists.debian.org (msg00015)	https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
12	lists.debian.org (msg00038)	https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html
13	lists.fedoraproject.org (4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4)	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
14	lists.fedoraproject.org (55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV)	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/
15	lists.fedoraproject.org (AY642Z6JZODQJE7Z62CFREVUHEGCXGPD)	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/
16	lists.fedoraproject.org (BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63)	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/
17	lists.fedoraproject.org (CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6)	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/
18	lists.fedoraproject.org (WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I)	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
19	pastebin.com (TdkC4pDv)	https://pastebin.com/TdkC4pDv
20	seclists.org (Oct/12)	http://seclists.org/fulldisclosure/2023/Oct/12
21	security-tracker.debian.org (CVE-2023-5217)	https://security-tracker.debian.org/tracker/CVE-2023-5217
22	security.gentoo.org (202310-04)	https://security.gentoo.org/glsa/202310-04
23	stackdiary.com (google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217)	https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/
24	twitter.com (status/1707163313711497266)	https://twitter.com/maddiestone/status/1707163313711497266
25	www.debian.org (dsa-5508)	https://www.debian.org/security/2023/dsa-5508
26	www.debian.org (dsa-5509)	https://www.debian.org/security/2023/dsa-5509
27	www.debian.org (dsa-5510)	https://www.debian.org/security/2023/dsa-5510
28	www.mozilla.org (mfsa2023-44)	https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/
29	www.openwall.com (oss-security/2023/09/28/5)	https://www.openwall.com/lists/oss-security/2023/09/28/5
30	www.openwall.com (oss-security/2023/09/28/5)	http://www.openwall.com/lists/oss-security/2023/09/28/5
31	www.openwall.com (oss-security/2023/09/28/6)	http://www.openwall.com/lists/oss-security/2023/09/28/6
32	www.openwall.com (oss-security/2023/09/29/1)	http://www.openwall.com/lists/oss-security/2023/09/29/1
33	www.openwall.com (oss-security/2023/09/29/11)	http://www.openwall.com/lists/oss-security/2023/09/29/11
34	www.openwall.com (oss-security/2023/09/29/12)	http://www.openwall.com/lists/oss-security/2023/09/29/12
35	www.openwall.com (oss-security/2023/09/29/14)	http://www.openwall.com/lists/oss-security/2023/09/29/14
36	www.openwall.com (oss-security/2023/09/29/2)	http://www.openwall.com/lists/oss-security/2023/09/29/2
37	www.openwall.com (oss-security/2023/09/29/7)	http://www.openwall.com/lists/oss-security/2023/09/29/7
38	www.openwall.com (oss-security/2023/09/29/9)	http://www.openwall.com/lists/oss-security/2023/09/29/9
39	www.openwall.com (oss-security/2023/09/30/1)	http://www.openwall.com/lists/oss-security/2023/09/30/1
40	www.openwall.com (oss-security/2023/09/30/2)	http://www.openwall.com/lists/oss-security/2023/09/30/2
41	www.openwall.com (oss-security/2023/09/30/3)	http://www.openwall.com/lists/oss-security/2023/09/30/3
42	www.openwall.com (oss-security/2023/09/30/4)	http://www.openwall.com/lists/oss-security/2023/09/30/4
43	www.openwall.com (oss-security/2023/09/30/5)	http://www.openwall.com/lists/oss-security/2023/09/30/5
44	www.openwall.com (oss-security/2023/10/01/1)	http://www.openwall.com/lists/oss-security/2023/10/01/1
45	www.openwall.com (oss-security/2023/10/01/2)	http://www.openwall.com/lists/oss-security/2023/10/01/2
46	www.openwall.com (oss-security/2023/10/01/5)	http://www.openwall.com/lists/oss-security/2023/10/01/5
47	www.openwall.com (oss-security/2023/10/02/6)	http://www.openwall.com/lists/oss-security/2023/10/02/6
48	www.openwall.com (oss-security/2023/10/03/11)	http://www.openwall.com/lists/oss-security/2023/10/03/11

変更履歴

No	変更内容	変更日
1	[2023年10月10日] 掲載	2023年10月10日15:23
2	[2025年07月24日] 参考情報：JVN (JVNVU#99891704) を追加参考情報：ICS-CERT ADVISORY (ICSA-25-203-04) を追加	2025年7月24日13:53