Porteus

Google has patched the fifth Chrome zero-day vulnerability exploited in attacks since the start of the year in emergency security updates released today.

"Google is aware that an exploit for CVE-2023-5217 exists in the wild," the company revealed in a security advisory published on Wednesday.

The security vulnerability is addressed in Google Chrome 117.0.5938.132, rolling out worldwide to Windows, Mac, and Linux users in the Stable Desktop channel.

While the advisory says it will likely take days or weeks until the patched version reaches the entire user base, the update was immediately available when BleepingComputer checked for updates.

The MITRE CVE dictionary describes this issue as:

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Google has rushed to patch another Chrome zero-day vulnerability exploited by a commercial spyware vendor.

The internet giant announced on Tuesday that the stable channel of Chrome for Windows, macOS and Linux has been updated to version 117.0.5938.132.

The latest update patches 10 vulnerabilities, three of which have been highlighted by the company in its advisory.

The most important vulnerability, tracked as CVE-2023-5217, has been described as a “heap buffer overflow in vp8 encoding in libvpx”. The issue was reported to the Chrome team by Clement Lecigne of Google’s Threat Analysis Group (TAG) just two days before the patch was released.

Google warned that CVE-2023-5217 has been exploited in the wild.

While the advisory does not provide any information on the attacks exploiting the zero-day, Google TAG researcher Maddie Stone revealed that it has been leveraged by a commercial surveillance vendor.

The news comes shortly after Google TAG and the University of Toronto’s Citizen Lab group released details on an operation whose goal was to deliver a piece of spyware known as Predator to an opposition politician in Egypt.

An analysis showed that the threat actor has used various zero-days and man-in-the-middle (MitM) attacks to deliver spyware to both Android and iOS devices.

Rava wrote:Is Porteus-v5.01 already hardened against the CVE-2023-5217?

Patrick Volkerding (born October 20, 1966) is the founder and maintainer of the Slackware Linux distribution. Volkerding is Slackware's "Benevolent Dictator for Life" (BDFL), and is also known informally as "The Man".