so.cl

Rascals are always sociable, and the chief sign that a man has any nobility in his character is the little pleasure he takes in others company. Arthur Schopenhauer


The WebP 0day

Early last week, Google released a new stable update for Chrome. The update included a single security fix that was reported by Apple’s Security Engineering and Architecture (SEAR) team. The issue, CVE-2023-4863, was a heap buffer overflow in the WebP image library, and it had a familiar warning attached:

“Google is aware that an exploit for CVE-2023-4863 exists in the wild.”

This means that someone, somewhere, had been caught using an exploit for this vulnerability. But who discovered the vulnerability and how was it being used? How does the vulnerability work? Why wasn’t it discovered earlier? And what sort of impact does an exploit like this have? The WebP 0day

September 22, 2023
#vulnerability ▪ #security