PT-2023-4481 · Google+3 · Google Chrome+3

Zhao Hai · Published 2023-08-15 · Updated 2024-11-29 · CVE-2023-4362

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 116.0.5845.96

Description The issue is related to a heap buffer overflow in the Mojom IDL component of Google Chrome, which could allow a remote attacker who has compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page.

Recommendations For Google Chrome versions prior to 116.0.5845.96, update to version 116.0.5845.96 or later to resolve the issue. As a temporary workaround, consider restricting access to crafted HTML pages that could exploit the heap buffer overflow in the Mojom IDL component until a patch is applied.

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

ALT-PU-2023-5067

ALT-PU-2023-5296

ALT-PU-2023-5790

ALT-PU-2023-6281

ALT-PU-2023-6350

ALT-PU-2023-6351

ALT-PU-2023-6567

ALT-PU-2024-14286

ALT-PU-2024-14830

BDU:2023-04876

CVE-2023-4362

DSA-5479-1

OPENSUSE-SU-2023:0234-1

OPENSUSE-SU-2023:0251-1

OPENSUSE-SU-2023_0251-1

OPENSUSE-SU-2024:13139-1

OPENSUSE-SU-2024:13144-1

OPENSUSE-SU-2024:13462-1

Affected Products

Alt Linux

Astra Linux

Google Chrome

Suse

References · 65

• https://osv.dev/vulnerability/openSUSE-SU-2023:0251-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-4362 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4362 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13139-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Vendor Advisory
• https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/697914 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13144-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04876 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2023:0234-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-4362 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5479-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-1227SE47MD · Vendor Advisory