PT-2023-1056 · Google+2 · Google Chrome+2

Asnine · Published 2023-01-10 · Updated 2024-06-15 · CVE-2023-0129

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 109.0.5414.74

Description The issue is related to a heap buffer overflow in the Network Service of Google Chrome, which could be exploited by an attacker who convinces a user to install a malicious extension. This exploitation could potentially lead to heap corruption via a crafted HTML page and specific interactions. The severity of this issue is considered high.

Recommendations For Google Chrome versions prior to 109.0.5414.74, update to version 109.0.5414.74 or later to resolve the issue. As a temporary workaround, consider disabling the installation of extensions until the update is applied. Restrict access to crafted HTML pages to minimize the risk of exploitation. Avoid interactions that could trigger the heap buffer overflow in the Network Service.

Exploit

Fix

Type Confusion

Memory Corruption

Weakness Enumeration

CWE-843

CWE-787

Related Identifiers

ALT-PU-2023-1047

ALT-PU-2023-1245

ALT-PU-2023-1410

ALT-PU-2023-1462

ALT-PU-2023-1603

ALT-PU-2023-1671

BDU:2023-00166

CVE-2023-0129

DSA-5317-1

MGASA-2023-0016

OPENSUSE-SU-2023:0016-1

OPENSUSE-SU-2024:12605-1

OPENSUSE-SU-2024:12778-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Astra Linux

Google Chrome

References · 2346

• 🔥 https://github.com/bjrjk/CVE-2022-4262 · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-4262 · Exploit
• 🔥 https://github.com/momika233/CVE-2022-3656 · Exploit
• 🔥❌ https://github.com/xem6/CVE-2022-4262 · Exploit, Deleted
• https://bdu.fstec.ru/vul/2023-00166 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12605-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0016-1 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-0129 · Vendor Advisory
• https://security.gentoo.org/glsa/202305-10 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0129 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5317-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0016 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0426SE17 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/688794 · Security Note