libwebp CVE-2023-4863 (heap buffer overflow from a crafted WebP image, exploited as a zero-day, CISA KEV): besides updating Chrome and Firefox, how do I find and fix old libwebp copies in Electron apps, containers and bundled libraries?

What it is: CVE-2023-4863 is a heap buffer overflow in libwebp, the library that decodes WebP images. Opening or rendering a crafted WebP image could corrupt memory and lead to code execution. It was reported by Apple and The Citizen Lab in September 2023 after being exploited in the wild, Google fixed it as a Chrome zero-day, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-09-13. (It was briefly also tracked as CVE-2023-5129.) Because libwebp is embedded in so many things (browsers, Electron desktop apps, image libraries, OS packages, container images), old copies remain common. Am I affected: - libwebp before 1.3.2, or anything that bundles it: Chrome before 116.0.5845.187; Firefox before 117.0.1, Firefox ESR before 115.2.1 / 102.15.1, Thunderbird before 102.15.1 / 115.2.2; Electron apps built on a Chromium from before the fix; language packages that ship their own copy (for example image-processing wheels and native modules). - Check: your OS package version (dpkg -l libwebp* or rpm -q libwebp), browser versions, and a software composition scan (SBOM tools such as Syft/Grype or Trivy find bundled libwebp in images and app folders). Fix: 1. Update browsers and email clients to current versions (they auto-update; make sure it isn't blocked by policy). 2. Update OS packages (apt/dnf upgrade for libwebp) and rebuild container images from updated base images. 3. Update desktop apps built on Electron or Chromium to versions released after the fix; ask vendors for fixed builds of apps that don't update themselves. 4. Upgrade language libraries that bundle libwebp to releases that include libwebp 1.3.2 or later, and rebuild native modules against the patched system library. 5. Where you process untrusted images on servers, decode them in a sandboxed, low-privilege worker. Verify: browsers show fixed or newer versions, OS packages and image scans report libwebp 1.3.2+, and your scanner no longer flags CVE-2023-4863. Sources: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/ https://github.com/webmproject/libwebp/releases/tag/v1.3.2 https://nvd.nist.gov/vuln/detail/CVE-2023-4863