PT-2023-3335 · Google+4 · Google Chrome+4

Avaue · Published 2023-01-24 · Updated 2024-10-17 · CVE-2023-0474

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 109.0.5414.119

Description The issue is related to a use after free in GuestView, which could potentially allow an attacker to exploit heap corruption via a Chrome web app if a user is convinced to install a malicious extension. This could lead to unauthorized access to confidential data, disruption of data integrity, and denial of service, potentially through a specially crafted HTML page.

Recommendations For Google Chrome versions prior to 109.0.5414.119, update to version 109.0.5414.119 or later to resolve the issue. As a temporary workaround, consider disabling the installation of extensions until the update is applied. Restrict access to Chrome web apps to minimize the risk of exploitation. Avoid using Chrome with untrusted or malicious extensions.

Fix

Use After Free

Heap Based Buffer Overflow

Weakness Enumeration

CWE-416

CWE-122

Related Identifiers

ALT-PU-2023-1152

ALT-PU-2023-1245

ALT-PU-2023-1410

ALT-PU-2023-1462

ALT-PU-2023-1603

ALT-PU-2023-1671

BDU:2023-03491

CVE-2023-0474

DSA-5328-1

MGASA-2023-0044

OPENSUSE-SU-2023:0032-1

OPENSUSE-SU-2023:0044-1

OPENSUSE-SU-2023:0115-1

OPENSUSE-SU-2023_0044-1

OPENSUSE-SU-2023_0115-1

OPENSUSE-SU-2024:12642-1

OPENSUSE-SU-2024:12948-1

USN-5881-1

Affected Products

Alt Linux

Astra Linux

Google Chrome

Suse

Ubuntu

References · 2362

• https://bdu.fstec.ru/vul/2023-03491 · Security Note
• https://osv.dev/vulnerability/DSA-5328-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-0474 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12642-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0474 · Security Note
• https://ubuntu.com/security/CVE-2023-0702 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0700 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0698 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0473 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0044.html · Security Note
• https://ubuntu.com/security/CVE-2023-0705 · Vendor Advisory
• https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop_24.html · Vendor Advisory