PT-2023-4481 · Google+3 · Google Chrome+3

Zhao Hai · Publicado 2023-08-15 · Atualizado 2024-11-29 · CVE-2023-4362

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 116.0.5845.96

Description The issue is related to a heap buffer overflow in the Mojom IDL component of Google Chrome, which could allow a remote attacker who has compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page.

Recommendations For Google Chrome versions prior to 116.0.5845.96, update to version 116.0.5845.96 or later to resolve the issue. As a temporary workaround, consider restricting access to crafted HTML pages that could exploit the heap buffer overflow in the Mojom IDL component until a patch is applied.

Correção

Memory Corruption

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-787

CWE-122

Identificadores relacionados

ALT-PU-2023-5067

ALT-PU-2023-5296

ALT-PU-2023-5790

ALT-PU-2023-6281

ALT-PU-2023-6350

ALT-PU-2023-6351

ALT-PU-2023-6567

ALT-PU-2024-14286

ALT-PU-2024-14830

BDU:2023-04876

CVE-2023-4362

DSA-5479-1

OPENSUSE-SU-2023:0234-1

OPENSUSE-SU-2023:0251-1

OPENSUSE-SU-2023_0251-1

OPENSUSE-SU-2024:13139-1

OPENSUSE-SU-2024:13144-1

OPENSUSE-SU-2024:13462-1

Produtos afetados

Alt Linux

Astra Linux

Google Chrome

Suse

Referências · 65

• https://osv.dev/vulnerability/openSUSE-SU-2023:0251-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2023-3422 · Nota
• https://suse.com/security/cve/CVE-2023-4362 · Nota
• https://suse.com/security/cve/CVE-2023-4368 · Nota
• https://suse.com/security/cve/CVE-2023-4354 · Nota
• https://suse.com/security/cve/CVE-2023-4071 · Nota
• https://suse.com/security/cve/CVE-2023-4351 · Nota
• https://security-tracker.debian.org/tracker/CVE-2023-4362 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2023-4365 · Nota
• https://suse.com/security/cve/CVE-2023-4352 · Nota
• https://suse.com/security/cve/CVE-2023-4077 · Nota
• https://t.me/cibsecurity/68595 · Publicação no Telegram
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-4362 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:13139-1 · Aviso do Fabricante