erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: September 27, 2023

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: libvpx CVE-2023-5217: Exploited VP8 Encoder Overflow. Owners of Electron apps or static media binaries built before late September 2023, end-of-life Linux hosts that still use libvpx, and fleets of iPhones or iPads stuck below iOS 16.7.1.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2023-5217

libvpx CVE-2023-5217: Exploited VP8 Encoder Overflow

Browsers fixed this within days in 2023 and have auto-updated many times since; what is left is stale libvpx copies in Electron apps, old iPhones, end-of-life Linux hosts and statically built media tools.

Must act: Owners of Electron apps or static media binaries built before late September 2023, end-of-life Linux hosts that still use libvpx, and fleets of iPhones or iPads stuck below iOS 16.7.1.

Can relax: Anyone on an auto-updating Chrome, Firefox or Edge, and supported Linux distributions with current security updates, which shipped backported libvpx fixes in 2023.

  1. Confirm browsers are current (Chrome at least 117.0.5938.132, Firefox at least 118.0.1 or ESR 115.3.1); any auto-updating install is far past this.
  2. Check distro libvpx packages by changelog, not version number, because distributions backported the fix to older releases.
  3. Search static binaries such as ffmpeg builds for the embedded libvpx version and rebuild anything below v1.13.1.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.