Security News > 2023 > September > Mozilla Rushes to Patch WebP Critical Zero-Day Exploit in Firefox and Thunderbird
Mozilla on Tuesday released security updates to resolve a critical zero-day vulnerability in Firefox and Thunderbird that has been actively exploited in the wild, a day after Google released a fix for the issue in its Chrome browser.
The shortcoming, assigned the identifier CVE-2023-4863, is a heap buffer overflow flaw in the WebP image format that could result in arbitrary code execution when processing a specially crafted image.
"We are aware of this issue being exploited in other products in the wild."
Apple Security Engineering and Architecture and the Citizen Lab at The University of Toronto's Munk School have been credited with reporting the security issue.
The development comes a day after Google released fixes for the same flaw in Chrome, noting it's "Aware that an exploit for CVE-2023-4863 exists in the wild."
Last week, Apple also released patches to plug two actively exploited security holes that the Citizen Lab said have been weaponized as part of a zero-click iMessage exploit chain named BLASTPASS to deploy the Pegasus spyware on fully-patched iPhones running iOS 16.6.
News URL
https://thehackernews.com/2023/09/mozilla-rushes-to-patch-webp-critical.html
Related news
- Mozilla Patches Critical Firefox Bug Similar to Chrome’s Recent Zero-Day Vulnerability (source)
- Choose your own Patch Tuesday adventure: Start with six zero day fixes, or six critical flaws (source)
- Zero-Day Alert: Google Releases Chrome Patch for Exploit Used in Russian Espionage Attacks (source)
- Mozilla warns Windows users of critical Firefox sandbox escape flaw (source)
- Netgear warns users to patch critical WiFi router vulnerabilities (source)
- XE Hacker Group Exploits VeraCore Zero-Day to Deploy Persistent Web Shells (source)
- SonicWall firewall exploit lets hackers hijack VPN sessions, patch now (source)
- Microsoft February 2025 Patch Tuesday fixes 4 zero-days, 55 flaws (source)
- Patch Tuesday: Microsoft Patches Two Actively Exploited Zero-Day Flaws (source)
- Critical PostgreSQL bug tied to zero-day attack on US Treasury (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-09-12 | CVE-2023-4863 | Out-of-bounds Write vulnerability in multiple products Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. network low complexity google fedoraproject debian mozilla microsoft webmproject netapp bentley bandisoft CWE-787 | 8.8 |