CVE-2023-5217

Key facts

CVSS score

8.8 (v3.1)

Severity

HIGH

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness (CWE)

CWE-787

EPSS score

49.0% (99th percentile)

In CISA KEV

Yes, added October 2, 2023

In EU EUVD

Yes (EUVD-2023-2578)

Published

September 28, 2023

NVD last modified

June 17, 2026

Status

Analyzed

Affected products

• apple / ipados
• apple / ipados
• apple / iphone os
• apple / iphone os
• debian / debian linux
• debian / debian linux
• debian / debian linux
• fedoraproject / fedora
• fedoraproject / fedora
• fedoraproject / fedora
• google / chrome
• microsoft / edge
• microsoft / edge
• microsoft / edge chromium
• microsoft / edge chromium
• mozilla / firefox
• mozilla / firefox
• mozilla / firefox
• mozilla / thunderbird
• redhat / enterprise linux
• webmproject / libvpx

Certified products that may be affected

12 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

• Red Hat Enterprise Linux 9 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5445 - active
• Red Hat Enterprise Linux 9 libgcrypt - Red Hat, Inc. - FIPS 140 5366 - active
• Red Hat Enterprise Linux 9 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5034 - active
• Red Hat Enterprise Linux 9 NSS Cryptographic Module - Red Hat, Inc - FIPS 140 5022 - active
• Apple iPadOS 17: iPad - Apple Inc. - Common Criteria CCEVS-VR-VID-11447-2025 - active

See all 12 in the Security Certifications Explorer.

References

• http://seclists.org/fulldisclosure/2023/Oct/12(Mailing List, Third Party Advisory)
• http://seclists.org/fulldisclosure/2023/Oct/16(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/09/28/5(Mailing List, Patch, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/09/28/6(Mailing List, Patch, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/09/29/1(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/09/29/11(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/09/29/12(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/09/29/14(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/09/29/2(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/09/29/7(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/09/29/9(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/09/30/1(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/09/30/2(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/09/30/3(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/09/30/4(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/09/30/5(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/10/01/1(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/10/01/2(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/10/01/5(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/10/02/6(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/10/03/11(Mailing List, Third Party Advisory)
• https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/(Third Party Advisory)
• https://bugzilla.redhat.com/show_bug.cgi?id=2241191(Issue Tracking, Third Party Advisory)
• https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html(Vendor Advisory)
• https://crbug.com/1486441(Exploit, Issue Tracking)
• https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590(Patch)
• https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282(Patch)
• https://github.com/webmproject/libvpx/releases/tag/v1.13.1(Release Notes)
• https://github.com/webmproject/libvpx/tags(Product)
• https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html(Mailing List)
• https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html(Mailing List)
• https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html(Mailing List)
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/(Mailing List)
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/(Mailing List)
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/(Mailing List)
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/(Mailing List)
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/(Mailing List)
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/(Mailing List)
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/(Mailing List)
• https://pastebin.com/TdkC4pDv(Not Applicable)