6751 – [Anolis OS 8] Bugfix for CVE-2023-5217

Bug 6751 - [Anolis OS 8] Bugfix for CVE-2023-5217

Summary: [Anolis OS 8] Bugfix for CVE-2023-5217

Status:	NEW

Alias:	None

Product:	Anolis OS 8
Classification:	Anolis OS
Component:	BaseOS Packages (show other bugs)	BaseOS Packages
Sub Component:
Version:	8.6
Hardware:	All Linux

Importance:	P2-High S2-major
Target Milestone:	---
Assignee:	wangkaiqiang
QA Contact:	shuming

URL:
Whiteboard:
Keywords:	CVE

Depends on:
Blocks:

Reported:	2023-10-10 15:12 UTC by 小龙
Modified:	2023-10-10 16:01 UTC (History)
CC List:	0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description 小龙 admin

2023-10-10 15:12:23 UTC

Description:
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Broken commit info:

Bugfix commit info:
https://github.com/electron/electron/pull/40026
https://github.com/electron/electron/pull/40025
https://github.com/electron/electron/pull/40022
https://github.com/electron/electron/pull/40023
https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282
https://github.com/electron/electron/pull/40024
https://hg.mozilla.org/mozilla-central/rev/c53f5ef77b62b79af86951a7f9130e1896b695d2