Is CefSharp affected by the security vulnerabilites CVE-2023-4863, CVE-2023-5217

[daveMueller]

Hi guys,

as we use CefSharp in one of our products it would be great if somebody could tell me if the library is also affected by the security vulnerabilities CVE-2023-4863, CVE-2023-5217.

https://nvd.nist.gov/vuln/detail/CVE-2023-4863
https://nvd.nist.gov/vuln/detail/CVE-2023-5217

Thanks a lot for any info ☺️.

[campersau]

Looks like it is, see "Security" Tab:
GHSA-j646-gj5p-p45g
GHSA-4c29-gfrp-g6x9

[daveMueller]

Thanks a lot for the quick feedback 🙏 . As far as I understand the issue seems to fixed in the newest versions of libvpx and libwebp. Does anybody know if a fix for CEF and CefSharp is already planned?

[campersau]

You can see that when you follow the links:

GHSA-j646-gj5p-p45g
Patched versions: 116.0.230

GHSA-4c29-gfrp-g6x9
Patched versions: 117.2.20

[daveMueller]

Thanks a lot @campersau 🙏