NewsSiemens ProductCERT

SSA-268517 V1.0: Code Execution Vulnerability (libwebp CVE-2023-4863) in Mendix Studio Pro

Mendix Studio Pro is vulnerable to an out of bounds write vulnerability in the integrated libwebp library (CVE-2023-4863), that could allow an attacker to execute code in the context of a victim user’s system. Siemens has released updates for the affected products and recommends to update to the latest versions.

CVE-2023-4863OSV-Eintrag
CVE-2023-4863libwebp: OOB write in BuildHuffmanTable
CVE-2023-4863libwebp: OOB write in BuildHuffmanTable
CVE-2023-4863Debian thunderbird: security update
CVE-2023-4863Google Chrome: Heap-basierter Pufferüberlauf
CVE-2023-4863Active Exploitation of High-Severity Vulnerability in Android Devices
CVE-2023-4863Critical Zero-day Vulnerability in Mozilla Firefox & Thunderbird
CVE-2023-4863libwebp: OOB write in BuildHuffmanTable
CVE-2023-4863libwebp heap overflow exploited in the wild (CVE-2023-4863)
CVE-2023-4863Debian libwebp: security update
CVE-2023-4863Google Chromium WebP — Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
CVE-2023-4863Debian libwebp: security update
CVE-2023-4863Active Exploitation of Zero-day Vulnerability in Google Chrome
CVE-2023-4863Debian firefox-esr: security update
CVE-2023-4863libwebp: OOB write in BuildHuffmanTable

Affected vendors and products

Android
Bandisoft
Bentley
Debian Debian Linux
Debian Firefox-esr
Debian Libwebp
Debian Thunderbird
Fedora Project Infrastructure Fedora
Google Google Chrome
Microsoft Microsoft Edge (Chromium-based)
Microsoft Microsoft Teams for Android
Microsoft Microsoft WebP Image Extension

Source: https://cert-portal.siemens.com/productcert/html/ssa-268517.html

Linked advisories

Affected vendors and products