CVE-2023-4863 is a critical vulnerability affecting a library for compressing webp images

The vulnerability CVE-2023-4863 is found in the open source Libwebp library and affects browsers such as Mozilla, Chrome and Edge

On September 6th, 2023 Apple Security Engineering and Architecture (SEAR) and The Citizen Lab at the University of Toronto reported a critical vulnerability affecting an image compression library used in Chromium and other software solutions that support WebP images.

WebP is an image format that offers superior lossless and lossy compression for images on the Web. Thanks to WebP, developers and webmasters have the ability to generate more compact, high-quality images, which leads to a significant improvement in the loading speed of web pages.

Google developed an open source library for manipulating images in WebP format, known as Libwebp, providing tools and functionality for encoding and decoding images in this format.

The CVE-2023-4863 vulnerability can be found in this library, specifically in the BuildHuffmanTable function used to validate the input data. The problem lies in the fact that this function allocates extra memory if the existing table is not large enough for the input data, allowing arbitrary data to be written outside of the bounds set in memory, when processing a malicious WebP image, which can lead to arbitrary code execution.

This vulnerability not only affects the Mozilla Firefox browser or others based on Chromium (Google Chrome, Microsoft Edge, Opera, Vivaldi, Brave, …) but also affects applications such as Thunderbird, Honeyview, Signal Electron, Affinity, Gimp, Inkscape, LibreOffice, Telegram, ffmpeg or 1Password, among others.

The Chromium team has already reported the exploitation of this zero-day in the wild, so it is recommended to update affected products as soon as possible.

Key features of CVE-2023-4863

The main characteristics of this vulnerability are detailed below:

  • CVE Identifier: CVE-2023-4863
  • Publishing date: 12/09/2023
  • Affected Software: Browsers such as Mozilla Firefox or Chromium based (Google Chrome, Microsoft Edge, Opera, Vivaldi, Brave); and applications such as Thunderbird, Honeyview, Signal Electron, Affinity, Gimp, Inkscape, LibreOffice, Telegram, ffmpeg or 1Password, among others.
  • CVSS Score: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
  • Affected versions
    • Multiple products are affected. The affected versions the lower versions than the listed in the Mitigation table.
CVE-2023-4863 affects major web browsers

Mitigation

The main solution is to urgently update the affected products to the new released versions that correct this vulnerability.

Some of the software versions fixing the vulnerability are listed below:

Affected Version Fixed Version Documentation
Google Chrome Ver. 116.0.5845.187 (Mac and Linux)
Ver. 116.0.5845.187/.188 (Windows)		 https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
Mozilla Firefox Ver. 117.0.1
Ver. ESR 102.15.1
Ver. ESR 115.2.1		 https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
Thunderbird Ver. 102.15.1
Ver. 115.2.2		  
Microsoft Edge Ver. 116.0.1938.81 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
Brave Ver. 1.58.124 https://github.com/brave/brave-browser/issues/33032
Opera Ver. 102.0.4880.51 https://blogs.opera.com/desktop/2023/09/opera-102-0-4880-51-stable-update/
Vivaldi Ver. 6.2 https://vivaldi.com/blog/desktop/minor-update-three-6-2/
Honeyview Ver. 5.51 https://en.bandisoft.com/honeyview/history/

Most of the affected products have automatic updates enabled by default, so a restart of the application is the only requirement. Otherwise, the patch should be applied manually as soon as possible.

It is important to mention that the affected products list continues to grow every day, so it is recommended to keep an eye out for future updates of this vulnerability.

Vulnerability detection

The details of the CVE-2023-463 vulnerability are complex, so it is recommended to trust on the patch released by the manufacturer that fixes the vulnerability and to verify that our affected applications/browsers have an equal or higher version.

As part of its emerging vulnerability service, Tarlogic proactively monitors its customers’ perimeter to report, detect and urgently notify the presence of this vulnerability, as well as other critical threats that could have a serious impact on the security of their assets.

References
  • https://nvd.nist.gov/vuln/detail/CVE-2023-4863
  • https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
  • https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
  • https://chromium.googlesource.com/webm/libwebp
  • https://bugzilla.redhat.com/show_bug.cgi?id=2238431