Packages / electron / Security

HighVulnerabilityGHSA-qqvq-6xgj-jw8gCVE-2023-5217Published 28 Sep 2023

Electron affected by libvpx's heap buffer overflow in vp8 encoding

Affected releases · electron

  • 26.x26.0.0 – 26.2.3Fixed in 26.2.4
  • 25.x25.0.0 – 25.8.3Fixed in 25.8.4
  • 24.x24.0.0 – 24.8.4Fixed in 24.8.5
  • 22.x22.0.0 – 22.3.24Fixed in 22.3.25
  • 21.x and older0.1.0 – 21.4.4No fix, no longer updated

On 26.x, the newest line:

npm install electron@26.2.4
45.x

  1. Not affected

    45.0.0

    1 release, latest

26.x

  1. Affected

    26.0.0 – 26.2.3

    6 releases

  2. Fixed

    26.2.4 – 26.6.10

    18 releases

25.x

  1. Affected

    25.0.0 – 25.8.3

    16 releases

  2. Fixed

    25.8.4 – 25.9.8

    10 releases

24.x

  1. Affected

    24.0.0 – 24.8.4

    25 releases

  2. Fixed

    24.8.5 – 24.8.8

    4 releases

22.x

  1. Affected

    22.0.0 – 22.3.24

    30 releases

  2. Fixed

    22.3.25 – 22.3.27

    3 releases

21.x

  1. Affected

    21.0.0 – 21.4.4

    18 releases

20.x

  1. Affected

    20.0.0 – 20.3.12

    23 releases

19.x

  1. Affected

    19.0.0 – 19.1.9

    28 releases

18.x

  1. Affected

    18.0.0 – 18.3.15

    25 releases

17.x

  1. Affected

    17.0.0 – 17.4.11

    20 releases

16.x

  1. Affected

    16.0.0 – 16.2.8

    22 releases

15.x

  1. Affected

    15.0.0 – 15.5.7

    24 releases

14.x

  1. Affected

    14.0.0 – 14.2.9

    15 releases

13.x

  1. Affected

    13.0.0 – 13.6.9

    29 releases

12.x

  1. Affected

    12.0.0 – 12.2.3

    26 releases

11.x

  1. Affected

    11.0.0 – 11.5.0

    27 releases

10.x

  1. Affected

    10.0.0 – 10.4.7

    22 releases

9.x

  1. Affected

    9.0.0 – 9.4.4

    22 releases

8.x

  1. Affected

    8.0.0 – 8.5.5

    25 releases

7.x

  1. Affected

    7.0.0 – 7.3.3

    26 releases

6.x

  1. Affected

    6.0.0 – 6.1.12

    26 releases

5.x

  1. Affected

    5.0.0 – 5.0.13

    14 releases

4.x

  1. Affected

    4.0.0 – 4.2.12

    28 releases

3.x

  1. Affected

    3.0.0 – 3.1.13

    31 releases

2.x

  1. Affected

    2.0.0 – 2.0.18

    19 releases

1.x

  1. Affected

    1.3.1 – 1.8.8

    79 releases

0.x

  1. Affected

    0.1.0 – 0.4.1

    8 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.