Comment on UPDATE YOUR BROWSERS IMMEDIATELY. RCE VULNERABILITY DISCOVERED

cheese_greater@lemmy.world ⁨11⁩ ⁨months⁩ ago

• towerful@programming.dev ⁨11⁩ ⁨months⁩ ago

  I’ve read elsewhere it’s actually a problem with libwebp not just chrome.
  Basically, anything that relies on libwebp (ie can play libwebp) is vulnerable.
  snyk.io/blog/critical-webp-0-day-cve-2023-4863/

  source

  • cheese_greater@lemmy.world ⁨11⁩ ⁨months⁩ ago

    I wonder if it applies to devices using LockDown mode, thats shuts down a lot of nonsense in its own right…

    source

    • towerful@programming.dev ⁨11⁩ ⁨months⁩ ago

      techtarget.com/…/Browser-companies-patch-critical…

      Citizen Lab said Blastpass was discovered on the device of an employee with “a Washington DC-based civil society organization” and that it could be mitigated by Apple’s Lockdown Mode. An investigation into the exploit chain continues, but researchers said it involved “PassKit attachments containing malicious images sent from an attacker iMessage account to the victim.”

      source

      • cheese_greater@lemmy.world ⁨11⁩ ⁨months⁩ ago

        Good, I’m so fucking tired of this bullshit.

        source

        • -> View More Comments
• Th3D3k0y@lemmy.world ⁨11⁩ ⁨months⁩ ago

  Current Description

  Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

  source

  • cheese_greater@lemmy.world ⁨11⁩ ⁨months⁩ ago

    By crafter webpage, does it mean it refers to anything like phishing or something a more savvy user wouldn’t likely “fall for” or does that actually not matter (zero-day or whatever)

    source

    • Feathercrown@lemmy.world ⁨11⁩ ⁨months⁩ ago

      Looks like it can do RCE without use interaction other than visiting the page-- not good!

      source
• Phen@lemmy.eco.br ⁨11⁩ ⁨months⁩ ago

  Discord, slack, MS Teams, Steam, pretty much anything. But most of them have already fixed it so if you let stuff update itself frequently, there’s little risk.

  source
• GamingChairModel@lemmy.world ⁨11⁩ ⁨months⁩ ago

  Apple also released urgent out-of-band security patches for iOS and MacOS around the same time, and disclosed that it had something to o do with imag processing. Unclear whether they use libwebp or some other implementation, but they disclosed that it was being actively exploited on iPhones.

  source