PT-2023-5638 · Google+3 · Google Chrome+3

Pwn2Car · Publicado 2023-09-27 · Atualizado 2024-11-29 · CVE-2023-5186

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 117.0.5938.132

Description The issue is related to a use after free vulnerability in the Passwords component of Google Chrome, which can lead to heap corruption. A remote attacker who convinces a user to engage in specific UI interaction can potentially exploit this issue. The attacker must craft specific UI interactions to exploit the vulnerability.

Recommendations For Google Chrome versions prior to 117.0.5938.132, update to version 117.0.5938.132 or later to resolve the issue. As a temporary workaround, consider avoiding specific UI interactions that may trigger the vulnerability until a patch is applied.

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

ALT-PU-2023-5936

ALT-PU-2023-5979

ALT-PU-2023-6281

ALT-PU-2023-6350

ALT-PU-2023-6351

ALT-PU-2023-6567

ALT-PU-2023-8219

ALT-PU-2023-8370

ALT-PU-2024-14286

ALT-PU-2024-14830

ALT-PU-2024-4260

ALT-PU-2024-4381

ALT-PU-2024-6148

BDU:2023-06298

CVE-2023-5186

DSA-5508-1

MGASA-2023-0283

OPENSUSE-SU-2023:0277-1

OPENSUSE-SU-2023:0297-1

OPENSUSE-SU-2023:0298-1

OPENSUSE-SU-2023_0297-1

OPENSUSE-SU-2023_0298-1

OPENSUSE-SU-2024:13269-1

OPENSUSE-SU-2024:13276-1

Produtos afetados

Alt Linux

Astra Linux

Google Chrome

Suse

Referências · 47

• https://twitter.com/ComputerPunks/status/1707854030016548961 · Publicação no Twitter
• https://lists.opensuse.org/archives/list/[e-mail]/thread/SA3UIF6YUP4F422WZCCPKQ6TLSBG7YAK · Nota
• https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html · Nota
• https://bugzilla.suse.com/1215778 · Nota
• https://security-tracker.debian.org/tracker/CVE-2023-5186 · Aviso do Fabricante
• https://security.gentoo.org/glsa/202401-34 · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4 · Aviso do Fabricante
• https://t.me/cibsecurity/71218 · Publicação no Telegram
• https://lists.opensuse.org/archives/list/[e-mail]/thread/V5KRGLOBRAIYNFCNZH4YM2ETGNMPQEKZ · Nota
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1225SE17MD · Aviso do Fabricante
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.9 · Nota
• https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:13276-1 · Aviso do Fabricante
• https://lists.opensuse.org/archives/list/[e-mail]/thread/XVWTK2X25FKSQAO2JO5SKRXBOHGOHPUO · Nota
• https://osv.dev/vulnerability/CVE-2023-5186 · Aviso do Fabricante