~ / search / GHSA-qqvq-6xgj-jw8g

GHSA-qqvq-6xgj-jw8g

Electron affected by libvpx's heap buffer overflow in vp8 encoding

Source: GitHub Advisory Database (reviewed) High CVE-2023-5217

Packages

EcosystemPackageAffectedFixed in
npm electron < 22.3.25 22.3.25
npm electron >= 24.0.0, < 24.8.5 24.8.5
npm electron >= 25.0.0, < 25.8.4 25.8.4
npm electron >= 26.0.0, < 26.2.4 26.2.4
npm electron >= 27.0.0-alpha.1, < 27.0.0-beta.8 27.0.0-beta.8

Details

As written in the advisory (Markdown source, shown as plain text).

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

References

External links from the advisory. They lead to third-party sites.