Vulnerability

Hologic lists SecurXChange Router and Chrome installs as affected by libwebp CVE-2023-4863

MedDevice Cyber Staff · Oct 12 · 2 min read · Via Hologic cybersecurity statement on CVE-2023-4863

Hologic published a statement on October 12, 2023 on CVE-2023-4863, the heap overflow in the libwebp image library. Hologic medical software does not process WebP images. The vulnerable library is still present in two places.

Google Chrome is installed on many Breast and Skeletal Health products for Unifi Connect registration, and Chrome must be at 116.0.5845.187 or higher. The SecurXChange Router runs an Ubuntu operating system carrying libwebp, updated via USN-6369-2 on router version 4.1.x or higher.

Hologic's application never touches WebP, yet its bundled browser and router OS both carry the library, so those components need patching on their own schedule.

Are you a representative of Hologic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update Chrome on Hologic Breast and Skeletal Health products to 116.0.5845.187 or higher, and apply the SecurXChange Router security update USN-6369-2 on version 4.1.x or higher. Hologic medical software itself does not process WebP images.

Update Chrome. Bring Chrome on every Breast and Skeletal Health product to 116.0.5845.187 or higher.
Update the router. Apply USN-6369-2 to SecurXChange Routers on version 4.1.x or higher.
Record the components. Add Chrome and libwebp to the SBOM for each affected product so the next library flaw is found faster.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

SecurXChange Router

PID-23 Named operating system Off-the-shelf software

Breast and Skeletal Health products

Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Is Hologic affected by the libwebp vulnerability CVE-2023-4863?

Hologic's October 12, 2023 statement says its medical software does not process WebP images, but libwebp is present in Google Chrome on Breast and Skeletal Health products and in the SecurXChange Router operating system.

What Chrome version does Hologic require for CVE-2023-4863?

Hologic says Chrome installed for Unifi Connect registration on Breast and Skeletal Health products must be 116.0.5845.187 or higher. The SecurXChange Router takes the fix through USN-6369-2 on version 4.1.x or higher.

← Back to Vulnerabilities