CVE-2023-4863

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

• libwebp-sys2 crates.io

  pkg:cargo/libwebp-sys2

  SEMVER range

  • All earlier versions (introduced 0)
  • Fixed boundary (excluded): 0.1.8

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• libwebp-sys crates.io

  pkg:cargo/libwebp-sys

  SEMVER range

  • All earlier versions (introduced 0)
  • Fixed boundary (excluded): 0.9.3

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• electron npm

  pkg:npm/electron

  SEMVER range

  • Introduced version (included): 22.0.0
  • Fixed boundary (excluded): 22.3.24

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• electron npm

  pkg:npm/electron

  SEMVER range

  • Introduced version (included): 24.0.0
  • Fixed boundary (excluded): 24.8.3

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• electron npm

  pkg:npm/electron

  SEMVER range

  • Introduced version (included): 25.0.0
  • Fixed boundary (excluded): 25.8.1

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• electron npm

  pkg:npm/electron

  SEMVER range

  • Introduced version (included): 26.0.0
  • Fixed boundary (excluded): 26.2.1

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• electron npm

  pkg:npm/electron

  SEMVER range

  • Introduced version (included): 27.0.0-beta.1
  • Fixed boundary (excluded): 27.0.0-beta.2

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• SkiaSharp NuGet

  pkg:nuget/SkiaSharp

  ECOSYSTEM range

  • Introduced version (included): 2.0.0
  • Fixed boundary (excluded): 2.88.6

  11 explicitly listed affected versions

  2.80.0, 2.80.1, 2.80.2, 2.80.3, 2.80.4, 2.88.0, 2.88.1, 2.88.2, 2.88.3, 2.88.4, 2.88.5

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• github.com/chai2010/webp Go

  pkg:golang/github.com/chai2010/webp

  SEMVER range

  • Introduced version (included): 1.1.2
  • Fixed boundary (excluded): 1.4.0

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• pillow PyPI

  pkg:pypi/pillow

  ECOSYSTEM range

  • All earlier versions (introduced 0)
  • Fixed boundary (excluded): 10.0.1

  93 explicitly listed affected versions

  1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 1.7.8, 10.0.0, 2.0.0, 2.1.0, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.8.0, 2.8.1, 2.8.2, 2.9.0, 3.0.0, 3.1.0, 3.1.0.rc1, 3.1.0rc1, 3.1.1, 3.1.2, 3.2.0, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.4.0, 3.4.1, 3.4.2, 4.0.0, 4.1.0, 4.1.1, 4.2.0, 4.2.1, 4.3.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.0.dev0, 5.4.1, 6.0.0, 6.1.0, 6.2.0, 6.2.1, 6.2.2, 7.0.0, 7.1.0, 7.1.1, 7.1.2, 7.2.0, 8.0.0, 8.0.1, 8.1.0, 8.1.1, 8.1.2, 8.2.0, 8.3.0, 8.3.1, 8.3.2, 8.4.0, 9.0.0, 9.0.1, 9.1.0, 9.1.1, 9.2.0, 9.3.0, 9.4.0, 9.5.0

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• webp crates.io

  pkg:cargo/webp

  SEMVER range

  • All earlier versions (introduced 0)
  • Fixed boundary (excluded): 0.2.6

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• magick.net-q16-anycpu NuGet

  pkg:nuget/magick.net-q16-anycpu

  ECOSYSTEM range

  • All earlier versions (introduced 0)
  • Fixed boundary (excluded): 13.3.0

  184 explicitly listed affected versions

  10.0.0, 10.1.0, 11.0.0, 11.1.0, 11.1.1, 11.1.2, 11.2.0, 11.2.1, 11.3.0, 12.0.0, 12.0.1, 12.1.0, 12.2.0, 12.2.1, 12.2.2, 12.3.0, 13.0.0, 13.0.1, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.2.0, 6.8.8.1001, 6.8.9.1, 6.8.9.101, 6.8.9.2, 6.8.9.401, 6.8.9.501, 6.8.9.601, 7.0.0.1, 7.0.0.10, 7.0.0.101, 7.0.0.102, 7.0.0.103, 7.0.0.104, 7.0.0.11, 7.0.0.12, 7.0.0.13, 7.0.0.14, 7.0.0.15, 7.0.0.16, 7.0.0.17, 7.0.0.18, 7.0.0.19, 7.0.0.2, 7.0.0.20, 7.0.0.21, 7.0.0.22, 7.0.0.3, 7.0.0.4, 7.0.0.5, 7.0.0.6, 7.0.0.7, 7.0.0.8, 7.0.0.9, 7.0.1, 7.0.1.100, 7.0.1.101, 7.0.1.500, 7.0.2.100, 7.0.2.400, 7.0.2.600, 7.0.2.900, 7.0.2.901, 7.0.2.902, 7.0.3, 7.0.3.1, 7.0.3.300, 7.0.3.500, 7.0.3.501, 7.0.3.502, 7.0.3.901, 7.0.3.902, 7.0.4.100, 7.0.4.400, 7.0.4.700, 7.0.4.701, 7.0.5.500, 7.0.5.501, 7.0.5.502, 7.0.5.800, 7.0.5.900, 7.0.6, 7.0.6.100, 7.0.6.1000, 7.0.6.1001, 7.0.6.1002, 7.0.6.101, 7.0.6.102, 7.0.6.600, 7.0.6.601, 7.0.7, 7.0.7.300, 7.0.7.700, 7.0.7.900, 7.1.0, 7.10.0, 7.10.1, 7.10.2, 7.11.0, 7.11.1, 7.12.0, 7.13.0, 7.13.1, 7.14.0, 7.14.0.1, 7.14.0.2, 7.14.0.3, 7.14.1, 7.14.2, 7.14.3, 7.14.4, 7.14.5, 7.15.0, 7.15.0.1, 7.15.1, 7.15.2, 7.15.3, 7.15.4, 7.15.5, 7.16.0, 7.16.1, 7.17.0, 7.17.0.1, 7.18.0, 7.19.0, 7.19.0.1, 7.2.0, 7.2.1, 7.20.0, 7.20.0.1, 7.21.0, 7.21.1, 7.22.0, 7.22.1, 7.22.2, 7.22.2.1, 7.22.2.2, 7.22.3, 7.23.0, 7.23.1, 7.23.2, 7.23.2.1, 7.23.3, 7.23.4, 7.24.0, 7.24.1, 7.3.0, 7.4.0, 7.4.1, 7.4.2, 7.4.3, 7.4.4, 7.4.5, 7.4.6, 7.5.0, 7.5.0.1, 7.6.0, 7.6.0.1, 7.7.0, 7.8.0, 7.9.0, 7.9.0.1, 7.9.0.2, 7.9.1, 7.9.2, 8.0.0, 8.0.1, 8.1.0, 8.2.0, 8.2.1, 8.3.0, 8.3.1, 8.3.2, 8.3.3, 8.4.0, 8.5.0, 8.6.0, 8.6.1, 9.0.0, 9.1.0, 9.1.1, 9.1.2

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• magick.net-q16-hdri-anycpu NuGet

  pkg:nuget/magick.net-q16-hdri-anycpu

  ECOSYSTEM range

  • All earlier versions (introduced 0)
  • Fixed boundary (excluded): 13.3.0

  181 explicitly listed affected versions

  10.0.0, 10.1.0, 11.0.0, 11.1.0, 11.1.1, 11.1.2, 11.2.0, 11.2.1, 11.3.0, 12.0.0, 12.0.1, 12.1.0, 12.2.0, 12.2.1, 12.2.2, 12.3.0, 13.0.0, 13.0.1, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.2.0, 6.8.9.101, 6.8.9.401, 6.8.9.501, 6.8.9.601, 7.0.0.1, 7.0.0.10, 7.0.0.101, 7.0.0.102, 7.0.0.103, 7.0.0.104, 7.0.0.11, 7.0.0.12, 7.0.0.13, 7.0.0.14, 7.0.0.15, 7.0.0.16, 7.0.0.17, 7.0.0.18, 7.0.0.19, 7.0.0.2, 7.0.0.20, 7.0.0.21, 7.0.0.22, 7.0.0.3, 7.0.0.4, 7.0.0.5, 7.0.0.6, 7.0.0.7, 7.0.0.8, 7.0.0.9, 7.0.1, 7.0.1.100, 7.0.1.101, 7.0.1.500, 7.0.2.100, 7.0.2.400, 7.0.2.600, 7.0.2.900, 7.0.2.901, 7.0.2.902, 7.0.3, 7.0.3.1, 7.0.3.300, 7.0.3.500, 7.0.3.501, 7.0.3.502, 7.0.3.901, 7.0.3.902, 7.0.4.100, 7.0.4.400, 7.0.4.700, 7.0.4.701, 7.0.5.500, 7.0.5.501, 7.0.5.502, 7.0.5.800, 7.0.5.900, 7.0.6, 7.0.6.100, 7.0.6.1000, 7.0.6.1001, 7.0.6.1002, 7.0.6.101, 7.0.6.102, 7.0.6.600, 7.0.6.601, 7.0.7, 7.0.7.300, 7.0.7.700, 7.0.7.900, 7.1.0, 7.10.0, 7.10.1, 7.10.2, 7.11.0, 7.11.1, 7.12.0, 7.13.0, 7.13.1, 7.14.0, 7.14.0.1, 7.14.0.2, 7.14.0.3, 7.14.1, 7.14.2, 7.14.3, 7.14.4, 7.14.5, 7.15.0, 7.15.0.1, 7.15.1, 7.15.2, 7.15.3, 7.15.4, 7.15.5, 7.16.0, 7.16.1, 7.17.0, 7.17.0.1, 7.18.0, 7.19.0, 7.19.0.1, 7.2.0, 7.2.1, 7.20.0, 7.20.0.1, 7.21.0, 7.21.1, 7.22.0, 7.22.1, 7.22.2, 7.22.2.1, 7.22.2.2, 7.22.3, 7.23.0, 7.23.1, 7.23.2, 7.23.2.1, 7.23.3, 7.23.4, 7.24.0, 7.24.1, 7.3.0, 7.4.0, 7.4.1, 7.4.2, 7.4.3, 7.4.4, 7.4.5, 7.4.6, 7.5.0, 7.5.0.1, 7.6.0, 7.6.0.1, 7.7.0, 7.8.0, 7.9.0, 7.9.0.1, 7.9.0.2, 7.9.1, 7.9.2, 8.0.0, 8.0.1, 8.1.0, 8.2.0, 8.2.1, 8.3.0, 8.3.1, 8.3.2, 8.3.3, 8.4.0, 8.5.0, 8.6.0, 8.6.1, 9.0.0, 9.1.0, 9.1.1, 9.1.2

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• magick.net-q16-x64 NuGet

  pkg:nuget/magick.net-q16-x64

  ECOSYSTEM range

  • All earlier versions (introduced 0)
  • Fixed boundary (excluded): 13.3.0

  200 explicitly listed affected versions

  10.0.0, 10.1.0, 11.0.0, 11.1.0, 11.1.1, 11.1.2, 11.2.0, 11.2.1, 11.3.0, 12.0.0, 12.0.1, 12.1.0, 12.2.0, 12.2.1, 12.2.2, 12.3.0, 13.0.0, 13.0.1, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.2.0, 6.8.5.1001, 6.8.5.401, 6.8.5.402, 6.8.6.301, 6.8.6.601, 6.8.6.801, 6.8.7.1, 6.8.7.101, 6.8.7.501, 6.8.7.502, 6.8.7.901, 6.8.8.1001, 6.8.8.201, 6.8.8.501, 6.8.8.701, 6.8.8.801, 6.8.8.901, 6.8.9.1, 6.8.9.101, 6.8.9.2, 6.8.9.401, 6.8.9.501, 6.8.9.601, 7.0.0.1, 7.0.0.10, 7.0.0.101, 7.0.0.102, 7.0.0.103, 7.0.0.104, 7.0.0.11, 7.0.0.12, 7.0.0.13, 7.0.0.14, 7.0.0.15, 7.0.0.16, 7.0.0.17, 7.0.0.18, 7.0.0.19, 7.0.0.2, 7.0.0.20, 7.0.0.21, 7.0.0.22, 7.0.0.3, 7.0.0.4, 7.0.0.5, 7.0.0.6, 7.0.0.7, 7.0.0.8, 7.0.0.9, 7.0.1, 7.0.1.100, 7.0.1.101, 7.0.1.500, 7.0.2.100, 7.0.2.400, 7.0.2.600, 7.0.2.900, 7.0.2.901, 7.0.2.902, 7.0.3, 7.0.3.1, 7.0.3.300, 7.0.3.500, 7.0.3.501, 7.0.3.502, 7.0.3.901, 7.0.3.902, 7.0.4.100, 7.0.4.400, 7.0.4.700, 7.0.4.701, 7.0.5.500, 7.0.5.501, 7.0.5.502, 7.0.5.800, 7.0.5.900, 7.0.6, 7.0.6.100, 7.0.6.1000, 7.0.6.1001, 7.0.6.1002, 7.0.6.101, 7.0.6.102, 7.0.6.600, 7.0.6.601, 7.0.7, 7.0.7.300, 7.0.7.700, 7.0.7.900, 7.1.0, 7.10.0, 7.10.1, 7.10.2, 7.11.0, 7.11.1, 7.12.0, 7.13.0, 7.13.1, 7.14.0, 7.14.0.1, 7.14.0.2, 7.14.0.3, 7.14.1, 7.14.2, 7.14.3, 7.14.4, 7.14.5, 7.15.0, 7.15.0.1, 7.15.1, 7.15.2, 7.15.3, 7.15.4, 7.15.5, 7.16.0, 7.16.1, 7.17.0, 7.17.0.1, 7.18.0, 7.19.0, 7.19.0.1, 7.2.0, 7.2.1, 7.20.0, 7.20.0.1, 7.21.0, 7.21.1, 7.22.0, 7.22.1, 7.22.2, 7.22.2.1, 7.22.2.2, 7.22.3, 7.23.0, 7.23.1, 7.23.2, 7.23.2.1, 7.23.3, 7.23.4, 7.24.0, 7.24.1, 7.3.0, 7.4.0, 7.4.1, 7.4.2, 7.4.3, 7.4.4, 7.4.5, 7.4.6, 7.5.0, 7.5.0.1, 7.6.0, 7.6.0.1, 7.7.0, 7.8.0, 7.9.0, 7.9.0.1, 7.9.0.2, 7.9.1, 7.9.2, 8.0.0, 8.0.1, 8.1.0, 8.2.0, 8.2.1, 8.3.0, 8.3.1, 8.3.2, 8.3.3, 8.4.0, 8.5.0, 8.6.0, 8.6.1, 9.0.0, 9.1.0, 9.1.1, 9.1.2

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• magick.net-q8-anycpu NuGet

  pkg:nuget/magick.net-q8-anycpu

  ECOSYSTEM range

  • All earlier versions (introduced 0)
  • Fixed boundary (excluded): 13.3.0

  184 explicitly listed affected versions

  10.0.0, 10.1.0, 11.0.0, 11.1.0, 11.1.1, 11.1.2, 11.2.0, 11.2.1, 11.3.0, 12.0.0, 12.0.1, 12.1.0, 12.2.0, 12.2.1, 12.2.2, 12.3.0, 13.0.0, 13.0.1, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.2.0, 6.8.8.1001, 6.8.9.1, 6.8.9.101, 6.8.9.2, 6.8.9.401, 6.8.9.501, 6.8.9.601, 7.0.0.1, 7.0.0.10, 7.0.0.101, 7.0.0.102, 7.0.0.103, 7.0.0.104, 7.0.0.11, 7.0.0.12, 7.0.0.13, 7.0.0.14, 7.0.0.15, 7.0.0.16, 7.0.0.17, 7.0.0.18, 7.0.0.19, 7.0.0.2, 7.0.0.20, 7.0.0.21, 7.0.0.22, 7.0.0.3, 7.0.0.4, 7.0.0.5, 7.0.0.6, 7.0.0.7, 7.0.0.8, 7.0.0.9, 7.0.1, 7.0.1.100, 7.0.1.101, 7.0.1.500, 7.0.2.100, 7.0.2.400, 7.0.2.600, 7.0.2.900, 7.0.2.901, 7.0.2.902, 7.0.3, 7.0.3.1, 7.0.3.300, 7.0.3.500, 7.0.3.501, 7.0.3.502, 7.0.3.901, 7.0.3.902, 7.0.4.100, 7.0.4.400, 7.0.4.700, 7.0.4.701, 7.0.5.500, 7.0.5.501, 7.0.5.502, 7.0.5.800, 7.0.5.900, 7.0.6, 7.0.6.100, 7.0.6.1000, 7.0.6.1001, 7.0.6.1002, 7.0.6.101, 7.0.6.102, 7.0.6.600, 7.0.6.601, 7.0.7, 7.0.7.300, 7.0.7.700, 7.0.7.900, 7.1.0, 7.10.0, 7.10.1, 7.10.2, 7.11.0, 7.11.1, 7.12.0, 7.13.0, 7.13.1, 7.14.0, 7.14.0.1, 7.14.0.2, 7.14.0.3, 7.14.1, 7.14.2, 7.14.3, 7.14.4, 7.14.5, 7.15.0, 7.15.0.1, 7.15.1, 7.15.2, 7.15.3, 7.15.4, 7.15.5, 7.16.0, 7.16.1, 7.17.0, 7.17.0.1, 7.18.0, 7.19.0, 7.19.0.1, 7.2.0, 7.2.1, 7.20.0, 7.20.0.1, 7.21.0, 7.21.1, 7.22.0, 7.22.1, 7.22.2, 7.22.2.1, 7.22.2.2, 7.22.3, 7.23.0, 7.23.1, 7.23.2, 7.23.2.1, 7.23.3, 7.23.4, 7.24.0, 7.24.1, 7.3.0, 7.4.0, 7.4.1, 7.4.2, 7.4.3, 7.4.4, 7.4.5, 7.4.6, 7.5.0, 7.5.0.1, 7.6.0, 7.6.0.1, 7.7.0, 7.8.0, 7.9.0, 7.9.0.1, 7.9.0.2, 7.9.1, 7.9.2, 8.0.0, 8.0.1, 8.1.0, 8.2.0, 8.2.1, 8.3.0, 8.3.1, 8.3.2, 8.3.3, 8.4.0, 8.5.0, 8.6.0, 8.6.1, 9.0.0, 9.1.0, 9.1.1, 9.1.2

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• magick.net-q8-openmp-x64 NuGet

  pkg:nuget/magick.net-q8-openmp-x64

  ECOSYSTEM range

  • All earlier versions (introduced 0)
  • Fixed boundary (excluded): 13.3.0

  81 explicitly listed affected versions

  10.0.0, 10.1.0, 11.0.0, 11.1.0, 11.1.1, 11.1.2, 11.2.0, 11.2.1, 11.3.0, 12.0.0, 12.0.1, 12.1.0, 12.2.0, 12.2.1, 12.2.2, 12.3.0, 13.0.0, 13.0.1, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.2.0, 7.14.0, 7.14.0.1, 7.14.0.2, 7.14.0.3, 7.14.1, 7.14.2, 7.14.3, 7.14.4, 7.14.5, 7.15.0, 7.15.0.1, 7.15.1, 7.15.2, 7.15.3, 7.15.4, 7.15.5, 7.16.0, 7.16.1, 7.17.0, 7.17.0.1, 7.18.0, 7.19.0, 7.19.0.1, 7.20.0, 7.20.0.1, 7.21.0, 7.21.1, 7.22.0, 7.22.1, 7.22.2, 7.22.2.1, 7.22.2.2, 7.22.3, 7.23.0, 7.23.1, 7.23.2, 7.23.2.1, 7.23.3, 7.23.4, 7.24.0, 7.24.1, 8.0.0, 8.0.1, 8.1.0, 8.2.0, 8.2.1, 8.3.0, 8.3.1, 8.3.2, 8.3.3, 8.4.0, 8.5.0, 8.6.0, 8.6.1, 9.0.0, 9.1.0, 9.1.1, 9.1.2

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• magick.net-q8-x64 NuGet

  pkg:nuget/magick.net-q8-x64

  ECOSYSTEM range

  • All earlier versions (introduced 0)
  • Fixed boundary (excluded): 13.3.0

  200 explicitly listed affected versions

  10.0.0, 10.1.0, 11.0.0, 11.1.0, 11.1.1, 11.1.2, 11.2.0, 11.2.1, 11.3.0, 12.0.0, 12.0.1, 12.1.0, 12.2.0, 12.2.1, 12.2.2, 12.3.0, 13.0.0, 13.0.1, 13.1.0, 13.1.1, 13.1.2, 13.1.3, 13.2.0, 6.8.5.1001, 6.8.5.401, 6.8.5.402, 6.8.6.301, 6.8.6.601, 6.8.6.801, 6.8.7.1, 6.8.7.101, 6.8.7.501, 6.8.7.502, 6.8.7.901, 6.8.8.1001, 6.8.8.201, 6.8.8.501, 6.8.8.701, 6.8.8.801, 6.8.8.901, 6.8.9.1, 6.8.9.101, 6.8.9.2, 6.8.9.401, 6.8.9.501, 6.8.9.601, 7.0.0.1, 7.0.0.10, 7.0.0.101, 7.0.0.102, 7.0.0.103, 7.0.0.104, 7.0.0.11, 7.0.0.12, 7.0.0.13, 7.0.0.14, 7.0.0.15, 7.0.0.16, 7.0.0.17, 7.0.0.18, 7.0.0.19, 7.0.0.2, 7.0.0.20, 7.0.0.21, 7.0.0.22, 7.0.0.3, 7.0.0.4, 7.0.0.5, 7.0.0.6, 7.0.0.7, 7.0.0.8, 7.0.0.9, 7.0.1, 7.0.1.100, 7.0.1.101, 7.0.1.500, 7.0.2.100, 7.0.2.400, 7.0.2.600, 7.0.2.900, 7.0.2.901, 7.0.2.902, 7.0.3, 7.0.3.1, 7.0.3.300, 7.0.3.500, 7.0.3.501, 7.0.3.502, 7.0.3.901, 7.0.3.902, 7.0.4.100, 7.0.4.400, 7.0.4.700, 7.0.4.701, 7.0.5.500, 7.0.5.501, 7.0.5.502, 7.0.5.800, 7.0.5.900, 7.0.6, 7.0.6.100, 7.0.6.1000, 7.0.6.1001, 7.0.6.1002, 7.0.6.101, 7.0.6.102, 7.0.6.600, 7.0.6.601, 7.0.7, 7.0.7.300, 7.0.7.700, 7.0.7.900, 7.1.0, 7.10.0, 7.10.1, 7.10.2, 7.11.0, 7.11.1, 7.12.0, 7.13.0, 7.13.1, 7.14.0, 7.14.0.1, 7.14.0.2, 7.14.0.3, 7.14.1, 7.14.2, 7.14.3, 7.14.4, 7.14.5, 7.15.0, 7.15.0.1, 7.15.1, 7.15.2, 7.15.3, 7.15.4, 7.15.5, 7.16.0, 7.16.1, 7.17.0, 7.17.0.1, 7.18.0, 7.19.0, 7.19.0.1, 7.2.0, 7.2.1, 7.20.0, 7.20.0.1, 7.21.0, 7.21.1, 7.22.0, 7.22.1, 7.22.2, 7.22.2.1, 7.22.2.2, 7.22.3, 7.23.0, 7.23.1, 7.23.2, 7.23.2.1, 7.23.3, 7.23.4, 7.24.0, 7.24.1, 7.3.0, 7.4.0, 7.4.1, 7.4.2, 7.4.3, 7.4.4, 7.4.5, 7.4.6, 7.5.0, 7.5.0.1, 7.6.0, 7.6.0.1, 7.7.0, 7.8.0, 7.9.0, 7.9.0.1, 7.9.0.2, 7.9.1, 7.9.2, 8.0.0, 8.0.1, 8.1.0, 8.2.0, 8.2.1, 8.3.0, 8.3.1, 8.3.2, 8.3.3, 8.4.0, 8.5.0, 8.6.0, 8.6.1, 9.0.0, 9.1.0, 9.1.1, 9.1.2

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• github.com/chai2010/webp Go

  pkg:golang/github.com/chai2010/webp

  SEMVER range

  • All earlier versions (introduced 0)
  • Fixed boundary (excluded): 0.0.0-20250406010349-76805d5a8860

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• github.com/chai2010/webp Go

  pkg:golang/github.com/chai2010/webp

  SEMVER range

  • Introduced version (included): 0.0.0
  • Fixed boundary (excluded): 1.1.2-0.20250406010349-76805d5a8860

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-j7hp-h8jx-5ppr/GHSA-j7hp-h8jx-5ppr.json"
    }
  }

  GitHub Advisory Database · GHSA-j7hp-h8jx-5ppr · Updated 2026-09-10T03:50:01.877717636Z
• pillow PyPI

  pkg:pypi/pillow

  ECOSYSTEM range

  • All earlier versions (introduced 0)
  • Fixed boundary (excluded): 10.0.1

  93 explicitly listed affected versions

  1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 1.7.8, 10.0.0, 2.0.0, 2.1.0, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.8.0, 2.8.1, 2.8.2, 2.9.0, 3.0.0, 3.1.0, 3.1.0.rc1, 3.1.0rc1, 3.1.1, 3.1.2, 3.2.0, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.4.0, 3.4.1, 3.4.2, 4.0.0, 4.1.0, 4.1.1, 4.2.0, 4.2.1, 4.3.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.0.dev0, 5.4.1, 6.0.0, 6.1.0, 6.2.0, 6.2.1, 6.2.2, 7.0.0, 7.1.0, 7.1.1, 7.1.2, 7.2.0, 8.0.0, 8.0.1, 8.1.0, 8.1.1, 8.1.2, 8.2.0, 8.3.0, 8.3.1, 8.3.2, 8.4.0, 9.0.0, 9.0.1, 9.1.0, 9.1.1, 9.2.0, 9.3.0, 9.4.0, 9.5.0

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2026-1794.yaml"
    }
  }

  PyPA · PYSEC-2026-1794 · Updated 2026-07-07T17:56:20.858779255Z
• libwebp-sys2 crates.io

  pkg:cargo/libwebp-sys2

  SEMVER range

  • Introduced version (included): 0.0.0-0
  • Fixed boundary (excluded): 0.1.8

  Additional upstream package constraints

  {
    "ecosystem": {
      "affected_functions": null,
      "affects": {
        "arch": [],
        "functions": [],
        "os": []
      }
    },
    "database": {
      "categories": [
        "memory-corruption"
      ],
      "cvss": null,
      "informational": null,
      "source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2023-0060.json"
    }
  }

  RustSec · RUSTSEC-2023-0060 · Updated 2026-07-07T17:56:20.858779255Z
• libwebp-sys crates.io

  pkg:cargo/libwebp-sys

  SEMVER range

  • Introduced version (included): 0.0.0-0
  • Fixed boundary (excluded): 0.9.3

  Additional upstream package constraints

  {
    "ecosystem": {
      "affected_functions": null,
      "affects": {
        "arch": [],
        "functions": [],
        "os": []
      }
    },
    "database": {
      "categories": [
        "memory-corruption"
      ],
      "cvss": null,
      "informational": null,
      "source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2023-0061.json"
    }
  }

  RustSec · RUSTSEC-2023-0061 · Updated 2026-07-07T17:56:20.858779255Z

Vendor product assessments

Showing 32 of 568 vendor product statements; 536 omitted. Read the full vendor advisory.

• firefox-0:102.15.1-1.el7_9.i686 as a component of Red Hat Enterprise Linux Client (v. 7) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_9?arch=i686

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect. Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• firefox-debuginfo-0:102.15.1-1.el7_9.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_9?arch=ppc64

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect. Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• firefox-debuginfo-0:102.15.1-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_9?arch=s390x

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect. Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• firefox-0:102.15.1-1.el7_9.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_9?arch=i686

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect. Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• libwebp-debuginfo-0:1.0.0-5.2.el8_1.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_1.1?arch=ppc64le

  • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• firefox-debugsource-0:102.15.1-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_2?arch=x86_64

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect. Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• firefox-debugsource-0:102.15.1-1.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_2?arch=ppc64le

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect. Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• thunderbird-0:102.15.1-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.2) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_2?arch=x86_64

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect. Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• thunderbird-debuginfo-0:102.15.1-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v. 8.2) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_2?arch=x86_64

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect. Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• firefox-0:102.15.1-1.el8_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.4) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_4?arch=aarch64

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect. Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• libwebp-debuginfo-0:1.0.0-7.el8_4.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.4) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_4.1?arch=x86_64

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• thunderbird-0:102.15.1-1.el8_4.src as a component of Red Hat Enterprise Linux AppStream E4S (v.8.4) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_4?arch=src

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect. Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• libwebp-java-debuginfo-0:1.0.0-7.el8_4.1.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.4) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_4.1?arch=i686

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• libwebp-0:1.0.0-7.el8_6.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_6.1?arch=ppc64le

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• libwebp-tools-debuginfo-0:1.0.0-7.el8_6.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_6.1?arch=aarch64

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• firefox-debuginfo-0:102.15.1-1.el8_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_8?arch=aarch64

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect. Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• libwebp-debugsource-0:1.0.0-8.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_8.1?arch=x86_64

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• thunderbird-debuginfo-0:102.15.1-1.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_8?arch=x86_64

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect. Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• libwebp-0:1.2.0-6.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_0?arch=x86_64

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• libwebp-tools-debuginfo-0:1.2.0-6.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_0?arch=ppc64le

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• firefox-debuginfo-0:102.15.1-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_2?arch=x86_64

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect. Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• libwebp-debugsource-0:1.2.0-7.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_2?arch=s390x

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• thunderbird-0:102.15.1-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_2?arch=aarch64

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect. Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• libwebp-debugsource-0:1.2.0-7.el9_2.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 9) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_2?arch=aarch64

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• libwebp-tools-debuginfo-0:1.2.0-7.el9_2.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 9) · fixed

  Vendor assessment for this product only.

  pkg:rpm/redhat/[email protected]_2?arch=x86_64

  • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• firefox as a component of Red Hat Enterprise Linux 6 · known affected

  Vendor assessment for this product only.

  pkg:rpm/redhat/firefox

  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
  • no fix planned: Out of support scope

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• firefox.src as a component of Red Hat Enterprise Linux 6 · known affected

  Vendor assessment for this product only.

  pkg:rpm/redhat/firefox?arch=src

  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
  • no fix planned: Out of support scope

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• libwebp as a component of Red Hat Enterprise Linux 7 · known not affected

  Vendor assessment for this product only.

  Reason: vulnerable code not present

  pkg:rpm/redhat/libwebp

  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• libwebp-devel as a component of Red Hat Enterprise Linux 7 · known not affected

  Vendor assessment for this product only.

  Reason: vulnerable code not present

  pkg:rpm/redhat/libwebp-devel

  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• libwebp-java as a component of Red Hat Enterprise Linux 7 · known not affected

  Vendor assessment for this product only.

  Reason: vulnerable code not present

  pkg:rpm/redhat/libwebp-java

  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• libwebp-tools as a component of Red Hat Enterprise Linux 7 · known not affected

  Vendor assessment for this product only.

  Reason: vulnerable code not present

  pkg:rpm/redhat/libwebp-tools

  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00
• libwebp.src as a component of Red Hat Enterprise Linux 7 · known not affected

  Vendor assessment for this product only.

  Reason: vulnerable code not present

  pkg:rpm/redhat/libwebp?arch=src

  • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  Red Hat · CVE-2023-4863 · Updated 2025-11-21T13:40:23+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

Additional exploitation reports

Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.

• VulnCheck KEV · 2023-09-06T00:00:00Z

  Source guidance: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  Source ransomware assessment: Unknown

  VulnCheck KEV · CVE-2023-4863 · Updated 2023-09-06T00:00:00Z
• VulnCheck KEV · 2023-09-06T00:00:00ZVulnCheck KEV · CVE-2023-4863
• VulnCheck KEV · 2023-09-11T00:00:00ZVulnCheck KEV · CVE-2023-4863
• VulnCheck KEV · 2023-09-12T00:00:00ZVulnCheck KEV · CVE-2023-4863
• VulnCheck KEV · 2023-09-13T00:00:00ZVulnCheck KEV · CVE-2023-4863
• VulnCheck KEV · 2024-02-02T00:00:00ZVulnCheck KEV · CVE-2023-4863
• VulnCheck KEV · 2024-03-21T00:00:00ZVulnCheck KEV · CVE-2023-4863
• VulnCheck KEV · 2024-03-27T00:00:00ZVulnCheck KEV · CVE-2023-4863
• VulnCheck KEV · 2025-03-26T00:00:00ZVulnCheck KEV · CVE-2023-4863
• VulnCheck KEV · 2025-05-30T00:00:00ZVulnCheck KEV · CVE-2023-4863