Summary

  • Mozilla has released security updates for Firefox and Thunderbird to fix a critical zero-day vulnerability that has been actively exploited in the wild.

  • The vulnerability, tracked as CVE-2023-4863, is a heap buffer overflow flaw in the WebP image format that could allow an attacker to execute arbitrary code on the victim’s computer.

  • The vulnerability is suspected to target individuals who are at an elevated risk, such as activists, dissidents, and journalists.

  • Mozilla has released Firefox 117.0.1, Firefox ESR 115.2.1, Firefox ESR 102.15.1, Thunderbird 102.15.1, and Thunderbird 115.2.2 to fix the vulnerability.

  • Google has also released a fix for the vulnerability in Chrome.

Additional Details

  • The WebP image format is a modern image format that is designed to be more efficient than other image formats, such as JPEG and PNG.

  • The heap buffer overflow vulnerability occurs when Firefox or Thunderbird attempts to decode a specially crafted WebP image.

  • The vulnerability could allow an attacker to execute arbitrary code on the victim’s computer by tricking them into opening a malicious WebP image.

  • Mozilla and Google have been working to fix the vulnerability since it was reported to them.

  • The security updates have been released for all supported versions of Firefox and Thunderbird.

  • Users are advised to update their browsers as soon as possible to protect themselves from this vulnerability.

    • Raisin8659@monyet.ccOP
      link
      fedilink
      English
      arrow-up
      38
      ·
      1 year ago

      Since webp is Google’s, I wouldn’t be surprised that everybody is using Google libwebp’s derived code to display webp images. There was an advisory to check updates for ALL your browsers on ALL platforms. Edge also had a recent update.

  • Treczoks@kbin.social
    link
    fedilink
    arrow-up
    10
    ·
    edit-2
    1 year ago

    Are there ways to test if a webp is malicious? Besides “Open it and see if you got infected”?

    Clarification: I consider any file that causes this overflow as malicious, regardless if it carries code or not.