NVD - CVE-2023-4863
nvd.nist.gov

Any Chromium and Firefox browser prior to version 116 will be vulnerable to this, update your browsers.

  • cheese_greater@lemmy.worldEnglish
    211·
    1 year ago

    What actual like platforms does this affect and to what extent tho? Like Mac (probably not iOS which is WebKit)?

        • towerful@programming.devEnglish
          7·
          1 year ago

          https://www.techtarget.com/searchsecurity/news/366551978/Browser-companies-patch-critical-zero-day-vulnerability

          Citizen Lab said Blastpass was discovered on the device of an employee with “a Washington DC-based civil society organization” and that it could be mitigated by Apple’s Lockdown Mode. An investigation into the exploit chain continues, but researchers said it involved “PassKit attachments containing malicious images sent from an attacker iMessage account to the victim.”

          Edit:

          Fuck my reading skill (or fuck articles listing multiple high profile CVEs)…
          Blastpass is not the same libwebp CVE (blastpass, the iMessage thing, is CVE-2023-41064. libwebp is CVE-2023-4863 - although that is the chrome one, despite this affecting libwebp not chrome).

          I think the whole situation is very rapidly being researched and it’s all developing.
          So, no idea if lockdown mode would have any effect

    • Th3D3k0y@lemmy.worldEnglish
      13·
      1 year ago

      Current Description

      Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

      • cheese_greater@lemmy.worldEnglish
        3·
        1 year ago

        By crafter webpage, does it mean it refers to anything like phishing or something a more savvy user wouldn’t likely “fall for” or does that actually not matter (zero-day or whatever)

    • Phen@lemmy.eco.brEnglish
      12·
      1 year ago

      Discord, slack, MS Teams, Steam, pretty much anything. But most of them have already fixed it so if you let stuff update itself frequently, there’s little risk.