PT-2025-39218 · Openssl+4 · Openssl+4

Publicado 2025-01-01 · Atualizado 2026-03-03 · CVE-2025-10891

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 140.0.7339.207 Chromium versions prior to 140.0.7339.207 Chromium versions prior to 140.0.7339.207-1deb12u1 (Debian bookworm) Chromium versions prior to 140.0.7339.207-1deb13u1 (Debian trixie) Chromium version 141.0.7390.76-alt0.p11.1

Description An integer overflow exists in the V8 JavaScript engine component of Google Chrome and Chromium-based browsers. This issue could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page, potentially leading to remote code execution or denial of service. Public proof-of-concept code is available. The vulnerability is due to an integer overflow occurring during the handling of user-hidden fields.

Recommendations Update Google Chrome to version 140.0.7339.207 or later. Update Chromium to version 140.0.7339.207 or later. For Debian bookworm, upgrade Chromium to version 140.0.7339.207-1deb12u1 or later. For Debian trixie, upgrade Chromium to version 140.0.7339.207-1deb13u1 or later. Update Chromium to version 141.0.7390.76-alt0.p11.1 or later.

Correção

RCE

Integer Overflow

Enumeração de Fraquezas

CWE-472

CWE-190

Identificadores relacionados

ALT-PU-2025-13054

BDU:2025-12391

CVE-2025-10891

DSA-6010-1

INFESA-2025_0007

OPENSUSE-SU-2025:15578-1

OPENSUSE-SU-2025:20020-1

Produtos afetados

Alt Linux

Debian

Google Chrome

Openssl

Red Os

Referências · 60

• https://twitter.com/ZeroPathLabs/status/1970916104747811054 · Publicação no Twitter
• https://bugzilla.suse.com/1251334 · Nota
• https://suse.com/security/cve/CVE-2025-11208 · Nota
• https://security-tracker.debian.org/tracker/CVE-2025-10891 · Aviso do Fabricante
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/3.1 · Nota
• https://suse.com/security/cve/CVE-2025-11460 · Nota
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.14 · Nota
• https://twitter.com/m411k_/status/2028225956616212656 · Publicação no Twitter
• https://twitter.com/zeeshankghouri/status/1972861516639805881 · Publicação no Twitter
• https://crbug.com/443765373 · Nota
• https://suse.com/security/cve/CVE-2025-11211 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-10891 · Nota de Segurança
• https://reddit.com/r/Action1/comments/1np7t9i/discrepancies_between_microsoft_defender_and · Publicação no Reddit
• https://twitter.com/CVEnew/status/1970892721322602874 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2025-10585 · Nota