CVE-2023-2137 Memory corruption in Chrome

High 8.8 Published 19 Apr 2023 Updated 13 Feb 2025

A heap buffer overflow in SQLite within Google Chrome allows remote attackers to execute arbitrary code via a crafted HTML page.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-2137?

CVE-2023-2137 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 19 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Weakness: CWE-787

Which versions are affected by CVE-2023-2137?

It affects 3 products.

Linux distribution packages (26)

`sqlite3` SUSE:Enterprise Storage 7.1	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise Micro 5.1	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise Micro 5.2	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise Micro 5.3	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise Micro 5.4	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise Micro 5.5	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise Micro 5.5	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise Module for Basesystem 15 SP4	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise Module for Basesystem 15 SP5	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise Server 12 SP5	All versions	`3.44.0-9.29.1`
`sqlite3` SUSE:Linux Enterprise Server 15 SP1-LTSS	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise Server 15 SP2-LTSS	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise Server 15 SP3-LTSS	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`3.44.0-9.29.1`
`sqlite3` SUSE:Linux Enterprise Server for SAP Applications 15 SP1	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise Server for SAP Applications 15 SP3	All versions	`3.44.0-150000.3.23.1`
`sqlite3` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`3.44.0-9.29.1`
`sqlite3` openSUSE:Leap 15.4	All versions	`3.44.0-150000.3.23.1`
`sqlite3` openSUSE:Leap 15.5	All versions	`3.44.0-150000.3.23.1`
`sqlite3` openSUSE:Leap Micro 5.3	All versions	`3.44.0-150000.3.23.1`
`sqlite3` openSUSE:Leap Micro 5.4	All versions	`3.44.0-150000.3.23.1`

Products include Debian Debian Linux, Fedoraproject Fedora, Google Chrome.

How do I fix CVE-2023-2137?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-2137 being exploited?

There is no known exploitation of CVE-2023-2137 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2023-2137, GHSA-6653-c3g4-g7jm, SUSE-SU-2023:4576-1, SUSE-SU-2023:4619-1, SUSE-SU-2024:2429-1.