Vulnerability Update - Remote Code Execution in Chrome (CVE-2023-5217)

Background

A critical vulnerability has been reported around remote code execution in Chrome, specifically known as ‘Google Chrome libvpx Heap Buffer Overflow Vulnerability’ - https://nvd.nist.gov/vuln/detail/CVE-2023-5217

Having conducted an analysis of our usage of this component, we believe this DOES presents a possible risk within our dashboard software, which could be exploited and therefore we plan to resolve this by patching our September 23 dashboard release to remedy the threat. .

Further updates will be added to this page as we make progress on the patch release, so please check back for more updates.

Events

To help keep customers informed of our latest responses to the issue, we have created an events table to detail the key steps we have/are taking;

Date	Event

Date	Event
Oct 2, 2023	We became aware of a critical vulnerability https://nvd.nist.gov/vuln/detail/CVE-2023-5217 and began to investigate.
Oct 5, 2023	Assessment of possible impact completed, and confirmed this could impact on our dashboard software.
Oct 5, 2023	Decision made to apply a patch to our September 23 dashboard release to provide greater resilience.
Oct 5, 2023	Development in progress
Oct 9, 2023	Development has been completed. The change has progressed through Unit and QA testing prior to release, expected to be ready on Oct 11, 2023.
Oct 11, 2023	A patched September (pi.2023_09.2) release is now available for customers to download.

Recommendations

Once the patch release has been made available, we strongly recommend that you upgrade to that version to take advantage of the security enhancement provided. We always encourage partners to upgrade to the latest version of the dashboard, to benefit from the very latest security fixes and features from both our software and our third-party providers.

Release Availability

The pi.2023_09.2 release is now available for customers to download from your usual outlets, depending on your deployment type.