CVE-2023-5217 (libvpx heap buffer overflow) tracking #258048

xyzeva · 2023-09-29T14:47:42Z

CVE-2023-5217 is a heap buffer overflow in libvpx's VP8 encoder, as many things such as electron and more are being tracked in this issue, so we can fix them in nixpkgs.

This vulnerability is yet to be rated, but we can assume (as its a heap buffer overflow), that it might be a big deal.

Current status

We currently have patched the libvpx package with #257941, vendored dependencies are tracked below.

How to help

Review/merge any nixpkgs PR that you see pending in the task list below.
If you have an idea of how to fix/address the vulnerability in any of the packages listed in the task list below, don't hesitate to post a comment here and send pull requests! Feel free to cc me on PRs so I can make sure they're tracked and they don't get lost.

Task list

This task list may or may not be complete, if you think we are missing something, please feel free to cc me! Here is the scan ran by @delroth for vulnerable dependencices

The text was updated successfully, but these errors were encountered:

xyzeva · 2023-09-29T14:58:27Z

@Kiwi: simplenote, binary provenance, package seems obsolete

xyzeva · 2023-09-29T14:59:35Z

@maxhille: aether, binary provenance, package seems obsolete

xyzeva · 2023-09-29T15:00:26Z

@06kellyjac: octant-desktop, binary provenance, upstream is archived

xyzeva · 2023-09-29T15:01:46Z

@noneucat: polar-bookshelf, binary provenance, package seems obsolete

xyzeva · 2023-09-29T15:06:21Z

@WolfangAukang: indigenous-desktop, binary provenance, package seems obsolete

xyzeva · 2023-09-29T15:08:16Z

@Mic92, @equirosa, @urandom2: signal-desktop, binary provenance, update available, priority is high

xyzeva · 2023-09-29T15:08:28Z

@Mic92, @equirosa, @urandom2: signal-desktop-beta, binary provenance, update available, priority is high

equirosa · 2023-09-29T15:24:09Z

On September 29, 2023 9:08:28 AM CST, Eva ***@***.***> wrote: @Mic92, @equirosa, @urandom2: signal-desktop, binary provenance, update available, priority is high

On it! :)

WolfangAukang · 2023-09-29T16:56:17Z

@WolfangAukang: indigenous-desktop, binary provenance, package seems obsolete

Not obsolete, they changed the repo name. I can build it from source, but the problem is that it does not work with an Electron version superior to 19.

WolfangAukang · 2023-09-29T17:00:27Z

Regarding threema-desktop (I'm the maintainer), there was a similar issue (#254798) that asked to remove lib/threema/threema-web, but as this package is using the bundled electron, it wasn't necessary to keep tracking.

Still I have this PR open that removes that component #255899

MikaelFangel · 2023-09-29T17:15:09Z

Brave is being updated in this PR #258060

WolfangAukang · 2023-09-29T17:29:41Z

Regarding thedesk (I'm the maintainer), this is a similar case as threema-desktop: application is using bundled electron version but the package contains the binary from the deb file.

PR: #258075

xyzeva · 2023-09-29T18:03:16Z

@travisbhartwell, @manveru, @prusnak: could we get electron fixes underway?

mweinelt · 2023-09-29T18:20:39Z

@WolfangAukang: indigenous-desktop, binary provenance, package seems obsolete

Not obsolete, they changed the repo name. I can build it from source, but the problem is that it does not work with an Electron version superior to 19.

Then it should be marked knownVulnerable, because they use an end-of-life and vulnerable electron version. Please make that happen if you are opposed to removing it.

WolfangAukang · 2023-09-29T18:44:34Z

@WolfangAukang: indigenous-desktop, binary provenance, package seems obsolete

Not obsolete, they changed the repo name. I can build it from source, but the problem is that it does not work with an Electron version superior to 19.

Then it should be marked knownVulnerable, because they use an end-of-life and vulnerable electron version. Please make that happen if you are opposed to removing it.

You mean knownVulnerabilities? Not able to find any examples with knownVulnerable.

xyzeva · 2023-09-29T18:57:39Z

New logs starting up by @delroth, should be more usable for reading seashell link

felschr · 2023-09-30T02:28:37Z

rhysmdnz · 2023-09-30T06:56:16Z

microsoft-edge: 117.0.2045.40 -> 117.0.2045.47 #258155

vcunat · 2023-10-01T06:01:16Z

In addition to the VP8 CVE above, there's now a VP9 CVE #258295 so maybe updating everything will need to be redone again?

xyzeva · 2023-10-01T08:16:51Z

In addition to the VP8 CVE above, there's now a VP9 CVE #258295 so maybe updating everything will need to be redone again?

We are talking about what to do with the new CVE on the matrix room, we are going to use the same tracking issue, probably

i077 · 2023-10-06T16:59:49Z

I think it is based on XUL, but I think the version of Firefox that comes from is very old. In the JS console in version 6.0.26, Services.appinfo.platformVersion evaluates to "60.9.0", but running the same in the browser console of the most recent release of Firefox evaluates to "118.0.1". Firefox 60.9.0 was released in September 2019. I don't know exactly how the scan was done, as the link to the scan results in the OP is broken.

I can contact their security email or post in the forums about this, but I'm not really sure what the best course of action here is in the meantime. There is Zotero 7 in beta, which patched this vulnerability in a recent build.

NickCao · 2023-10-06T19:36:45Z

qtwebengine uses system libvpx thus should not be affected.

MikaelFangel · 2023-10-09T00:41:54Z

I have applied a patch for the CVE in freeswitch in this pr: #259881

MikaelFangel · 2023-10-09T01:30:59Z

Suggesting to remove simplenote in: #259889

MikaelFangel · 2023-10-09T20:12:59Z

I looked at mattermost-desktop, and it doesn't use the shipped Electron version, rather it uses the Electron_26 from nixpkgs. Thus, if I haven't missed anything, it should be resolved, right?

See the line here. 😃

MikaelFangel · 2023-10-11T19:18:09Z

Also should mullvad-vpn not be on the list? It was also found by the vendoring checker https://clbin.com/haJzA. It has an upstream release bundling a new Electron version.

And the pr updating it can be found here #260407

maxhille · 2023-10-13T06:54:05Z

@xyzeva aether is now removed from master by #258556

qbit · 2023-10-13T15:23:05Z

For tidal-hifi there is a push to get it building from source: #252307 - I am not versed enough to be able to help.. maybe someone else can?

MikaelFangel · 2023-10-16T12:39:28Z

Mark figma-linux as vulnerable to this CVE in #261404 until fix is available.

Maintainer will update on next release see: Figma-Linux/figma-linux#341 (comment)

MikaelFangel · 2023-10-20T20:52:43Z

I suggest marking pulsar, as vulnerable in #262376 because it uses a very outdated version of electron and doesn't seem to plan to bundle a new version anytime soon.

MikaelFangel · 2023-10-21T00:14:27Z

Update pycharm here: #262418

And idea was updated by this pr: #260965

MikaelFangel · 2023-10-21T00:54:11Z

Have opened a draft pr fixing nwjs #262424, but I still need to do some more testing to ensure nothing breaks.

Edit
Corrected the pr, so it points to the pr...

Zotero 6 is based on Firefox 60 and has not patched this vulnerability. The next version is based on Firefox 102 (ESR) and has patched this, but is is still in beta. See also NixOS#258048.

i077 · 2023-10-22T21:46:03Z

The current stable version of Zotero, based on Firefox 60 as discussed earlier here, is not going to get patched from what I can tell, so #262808 marks it as vulnerable until Zotero 7 hits GA.

Zotero 6 is based on Firefox 60 and has not patched this vulnerability. The next version is based on Firefox 102 (ESR) and has patched this, but is is still in beta. See also #258048. (cherry picked from commit 9438baa)

Inkbottle007 · 2023-11-07T06:01:27Z

The current stable version of Zotero, based on Firefox 60 as discussed earlier here, is not going to get patched from what I can tell, so #262808 marks it as vulnerable until Zotero 7 hits GA.

Hi, as much as I would love to see Zotero 7 come to GA, it seems Zotero 6 has been patched: "Changes in 6.0.30 (November 2, 2023), [Security] Disabled libvpx support (CVE-2023-5217)" (https://www.zotero.org/support/changelog).

camillemndn · 2023-11-07T10:19:19Z

The current stable version of Zotero, based on Firefox 60 as discussed earlier here, is not going to get patched from what I can tell, so #262808 marks it as vulnerable until Zotero 7 hits GA.

Hi, as much as I would love to see Zotero 7 come to GA, it seems Zotero 6 has been patched: "Changes in 6.0.30 (November 2, 2023), [Security] Disabled libvpx support (CVE-2023-5217)" (https://www.zotero.org/support/changelog).

Hi, for those interested, I managed to package Zotero 7 built from source in https://github.com/camillemndn/nixos-config/tree/main/pkgs/applications/office/zotero, but I could not upstream it since it is based on Firefox 102 which is already deprecated...

shlevy · 2023-11-07T10:33:40Z

Opened #266033 to update Zotero 6

Inkbottle007 · 2023-11-20T19:03:56Z

Hi, for those interested, I managed to package Zotero 7 built from source in https://github.com/camillemndn/nixos-config/tree/main/pkgs/applications/office/zotero, but I could not upstream it since it is based on Firefox 102 which is already deprecated...

Good job building Zotero 7 from source. Zotero seems like a Heath Robinson machine and the only way to distribute is is through its prebuilt which is what the Zotero 6 nixos package is doing I understand. I don't know why they need to vendor Firefox but that's another story.

mweinelt pinned this issue Sep 29, 2023

06kellyjac mentioned this issue Sep 29, 2023

octant{,-desktop},starboard-octant-plugin: drop #258061

Merged

12 tasks

WolfangAukang mentioned this issue Sep 29, 2023

thedesk: remove original binary from package #258075

Merged

12 tasks

panicgh mentioned this issue Sep 29, 2023

tor-browser: 12.5.5 -> 12.5.6 #258116

Merged

12 tasks

equirosa mentioned this issue Sep 30, 2023

signal-desktop: 6.31.0 -> 6.32.0, 6.32.0-beta.1 -> 6.33.0-beta.1 #258129

Merged

12 tasks

yayayayaka mentioned this issue Sep 30, 2023

electron-bin 22/24/25/26 version bumps for CVE-2023-5217 #258146

Merged

12 tasks

yayayayaka mentioned this issue Sep 30, 2023

[Backport release-23.05] signal-desktop: 6.30.2 -> 6.32.0, 6.32.0-beta.1 -> 6.33.0-beta.1 #258229

Merged

12 tasks

Cynosphere mentioned this issue Sep 30, 2023

Bump Electron to 25.8.4 for CVE-2023-5217 Vencord/Vesktop#134

Merged

equirosa mentioned this issue Sep 30, 2023

[Backport Release-23.05] signal-desktop: 6.31.0 -> 6.32.0, 6.32.0-beta.1 -> 6.33.0-beta.1 #258265

Closed

12 tasks

MikaelFangel mentioned this issue Sep 30, 2023

joplin-desktop: 2.12.16 -> 2.12.18 #258286

Merged

12 tasks

toonn mentioned this issue Oct 9, 2023

Wire desktop bump #259996

Merged

12 tasks

LeSuisse mentioned this issue Oct 9, 2023

[23.05] rocketchat-desktop: 3.9.7 -> 3.9.9 #260041

Merged

12 tasks

MikaelFangel mentioned this issue Oct 12, 2023

caprine-bin: 2.58.3 -> 2.59.1 #260561

Merged

12 tasks

ShamrockLee mentioned this issue Oct 18, 2023

losslesscut-bin: 3.55.2 -> 3.58.0 #261876

Merged

12 tasks

FliegendeWurst added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Oct 21, 2023

i077 mentioned this issue Oct 22, 2023

zotero: mark as insecure (CVE-2023-5217) #262808

Merged

13 tasks

K900 unpinned this issue Nov 1, 2023

WolfangAukang mentioned this issue Nov 8, 2023

indiepass-desktop: init at unstable-2023-05-19 #266345

Merged

13 tasks

WolfangAukang mentioned this issue Dec 8, 2023

[Backport release-23.11] indiepass-desktop: init at unstable-2023-05-19 #272917

Merged

13 tasks

mweinelt mentioned this issue Mar 14, 2024

electron-bin is chronically outdated #295770

Open

samueldr added the 5. scope: tracking Long-lived issue tracking long-term fixes or multiple sub-problems label Apr 23, 2024

CVE-2023-5217 (libvpx heap buffer overflow) tracking #258048

CVE-2023-5217 (libvpx heap buffer overflow) tracking #258048

Comments

xyzeva commented Sep 29, 2023 • edited by eclairevoyant Loading

Current status

How to help

Task list

xyzeva commented Sep 29, 2023

xyzeva commented Sep 29, 2023

xyzeva commented Sep 29, 2023

xyzeva commented Sep 29, 2023

xyzeva commented Sep 29, 2023

xyzeva commented Sep 29, 2023

xyzeva commented Sep 29, 2023

equirosa commented Sep 29, 2023 via email

WolfangAukang commented Sep 29, 2023

WolfangAukang commented Sep 29, 2023

MikaelFangel commented Sep 29, 2023

WolfangAukang commented Sep 29, 2023 • edited Loading

xyzeva commented Sep 29, 2023

mweinelt commented Sep 29, 2023 • edited Loading

WolfangAukang commented Sep 29, 2023

xyzeva commented Sep 29, 2023

felschr commented Sep 30, 2023

rhysmdnz commented Sep 30, 2023

vcunat commented Oct 1, 2023

xyzeva commented Oct 1, 2023

i077 commented Oct 6, 2023

NickCao commented Oct 6, 2023

MikaelFangel commented Oct 9, 2023

MikaelFangel commented Oct 9, 2023

MikaelFangel commented Oct 9, 2023

MikaelFangel commented Oct 11, 2023 • edited Loading

maxhille commented Oct 13, 2023

qbit commented Oct 13, 2023

MikaelFangel commented Oct 16, 2023

MikaelFangel commented Oct 20, 2023 • edited Loading

MikaelFangel commented Oct 21, 2023 • edited Loading

MikaelFangel commented Oct 21, 2023 • edited Loading

i077 commented Oct 22, 2023

Inkbottle007 commented Nov 7, 2023

camillemndn commented Nov 7, 2023

shlevy commented Nov 7, 2023

Inkbottle007 commented Nov 20, 2023

xyzeva commented Sep 29, 2023 •

edited by eclairevoyant

Loading

WolfangAukang commented Sep 29, 2023 •

edited

Loading

mweinelt commented Sep 29, 2023 •

edited

Loading

MikaelFangel commented Oct 11, 2023 •

edited

Loading

MikaelFangel commented Oct 20, 2023 •

edited

Loading

MikaelFangel commented Oct 21, 2023 •

edited

Loading

MikaelFangel commented Oct 21, 2023 •

edited

Loading