Black Arrow Cyber Advisory 15 September 2023 – Critical Vulnerability in Multiple Browsers, Update Now

Executive summary

A critical vulnerability in WebP has been identified as being actively exploited. The vulnerability impacts multiple browsers including Chrome, Edge, Firefox and Opera and any software using the libwebp library. Successful exploitation can lead to malicious code execution.

What’s the risk to me or my business?

The actively exploited vulnerability can allow an attacker to execute malicious code on vulnerable software, compromising the confidentiality, integrity and availability of data.

What can I do?

Security updates are available for browsers impacted; these should be applied immediately. It has been noted that other applications which use the libwebp library are also impacted and it is recommended that organisations check if the software they use is vulnerable.

Technical Summary

CVE-2023-4863: The actively exploited vulnerability allows an attacker to perform a heap buffer overflow attack, allowing them to execute malicious code.

Further details on the vulnerability can be found here:

https://nvd.nist.gov/vuln/detail/CVE-2023-4863

https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/

The security advisory from Google Chrome can be found here:

https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html

The security advisory from Firefox can be found here:

https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/

The security advisory from Microsoft can be found here:

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-4863

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity