PT-2023-9434 · Google+2 · V8 Javascript Engine+3

Published 2023-11-11 · Updated 2025-01-02 · CVE-2024-7022

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 123.0.6312.58

Description The issue is related to the use of uninitialized variables in the V8 JavaScript engine of Google Chrome. This could allow a remote attacker to perform out of bounds memory access via a specially crafted HTML page, potentially leading to the execution of arbitrary code.

Recommendations For versions prior to 123.0.6312.58, update to version 123.0.6312.58 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable HTML pages until the update is applied.

Exploit

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-457

CWE-908

Related Identifiers

BDU:2024-07567

CVE-2024-7022

DSA-5648-1

Affected Products

Astra Linux

Debian

Google Chrome

V8 Javascript Engine

References · 16

• 🔥 https://issues.chromium.org/issues/324690505 · Exploit
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5648-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-7022 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20241017SE16 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-7022 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-7022 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07567 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-7022 · Security Note
• https://feedly.com/cve/CVE-2024-7022 · Note
• https://t.me/cvedetector/6221 · Telegram Post
• https://twitter.com/CVEnew/status/1838341617167581688 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1838383262382674389 · Twitter Post
• https://twitter.com/cracbot/status/1839183211093737555 · Twitter Post
• https://vuldb.com/?id.278335 · Note