PT-2023-5638 · Google+3 · Google Chrome+3

Pwn2Car · Published 2023-09-27 · Updated 2024-11-29 · CVE-2023-5186

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 117.0.5938.132

Description The issue is related to a use after free vulnerability in the Passwords component of Google Chrome, which can lead to heap corruption. A remote attacker who convinces a user to engage in specific UI interaction can potentially exploit this issue. The attacker must craft specific UI interactions to exploit the vulnerability.

Recommendations For Google Chrome versions prior to 117.0.5938.132, update to version 117.0.5938.132 or later to resolve the issue. As a temporary workaround, consider avoiding specific UI interactions that may trigger the vulnerability until a patch is applied.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2023-5936

ALT-PU-2023-5979

ALT-PU-2023-6281

ALT-PU-2023-6350

ALT-PU-2023-6351

ALT-PU-2023-6567

ALT-PU-2023-8219

ALT-PU-2023-8370

ALT-PU-2024-14286

ALT-PU-2024-14830

ALT-PU-2024-4260

ALT-PU-2024-4381

ALT-PU-2024-6148

BDU:2023-06298

CVE-2023-5186

DSA-5508-1

MGASA-2023-0283

OPENSUSE-SU-2023:0277-1

OPENSUSE-SU-2023:0297-1

OPENSUSE-SU-2023:0298-1

OPENSUSE-SU-2023_0297-1

OPENSUSE-SU-2023_0298-1

OPENSUSE-SU-2024:13269-1

OPENSUSE-SU-2024:13276-1

Affected Products

Alt Linux

Astra Linux

Google Chrome

Suse

References · 47

• https://security-tracker.debian.org/tracker/CVE-2023-5186 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1225SE17MD · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13276-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5186 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-5186 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0298-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5508-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13269-1 · Vendor Advisory
• https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0297-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0277-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0283 · Vendor Advisory