Zero Day Vulnerability

Here is some more information on the Zero Day Vulnerability CVE-2023-5129 which has a Most Severe rating.

How bad is the vulnerability?

• Successful exploitation could potentially result in attackers taking control of a system, executing arbitrary code, and accessing sensitive user data.
• The vulnerability affects but is not limited to major browsers like Chrome, Firefox, Safari, and Edge.
• Already being exploited by threat actors: Linked to (Citizen Lab's BLASTPASS report) a zero-click, zero-day iPhone exploit form 07/09/2023 Earlier this month (11/09/2023), Google acknowledged that this was being exploited in the wild.

What applications are affected?

Any software that utilizes the WebP codec (libwebp), including the below popular apps:

• Android phones and all it's apps
• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge
• Microsoft Teams
• 1Password
• Bitwarden
• CrashPlan
• Discord
• GitHub Desktop
• GitKraken
• Logitech Options +
• Signal
• Skype
• Slack
• TIDAL
• Twitch
• Visual Studio Code
• Wire

Full list of applications using the codec is unknown due to the widespread use of the codec, however a more comprehensive list can be found at the site's below

• https://www.cyberkendra.com/2023/09/webp-0day-google-assign-new-cve-for.html
• https://en.wikipedia.org/wiki/WebP

What patches are available for this?

At the time of writing, the following software are known to have pushed out a patch to combat the issue:

• Google Chrome – Mac and Linux 116.0.5845.187 and Windows 116.0.5845.187/.188.
• Mozilla – Firefox 117.0.1, Firefox ESR 115.2.1, Firefox ESR 102.15.1, Thunderbird 102.15.1, and Thunderbird 115.2.2
• Brave Browser – version 1.57.64 (Chromium: 116.0.5845.188) [Android, iOS, Linux & Mac].
• Microsoft Edge – versions 109.0.1518.140, 116.0.1938.81, and 117.0.2045.31.
• Tor Browser – version 12.5.4.
• Opera – version 102.0.4880.46.
• Vivaldi – version 6.2.3105.47.
• Bitwarden
• LibreOffice
• Suse
• Ubuntu
• LosslessCut
• NixOS - Nix package manager

If you want to find out more please get in touch.

Source: https://www.cyberkendra.com/2023/09/webp-0day-google-assign-new-cve-for.html