PT-2024-1065 · Google+4 · Google Chrome+5

Suto

+2

·

Published

2024-01-03

·

Updated

2024-11-29

·

CVE-2024-0223

CVSS v2.0

10

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 120.0.6099.199
Description A heap buffer overflow in the ANGLE library of Google Chrome allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue is related to the WebGL Vulkan Spirv bytecode builder length truncate, which can lead to a heap overflow. This can potentially allow an attacker to execute arbitrary code. The Chromium security severity of this issue is High.
Recommendations For Google Chrome versions prior to 120.0.6099.199, update to version 120.0.6099.199 or later to resolve the issue. As a temporary workaround, consider restricting access to WebGL and Vulkan functionalities until the update is applied. Avoid using crafted HTML pages that can trigger the heap buffer overflow in the ANGLE library.

Exploit

Fix

Memory Corruption

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2024-10294
ALT-PU-2024-14286
ALT-PU-2024-14830
ALT-PU-2024-2062
ALT-PU-2024-3216
BDU:2024-00297
CVE-2024-0223
DSA-5595-1
MGASA-2024-0011
OPENSUSE-SU-2024:0016-1
OPENSUSE-SU-2024:0020-1
OPENSUSE-SU-2024:13583-1
OPENSUSE-SU-2024:13585-1
OPENSUSE-SU-2024_0016-1

Affected Products

Alt Linux
Angle Library
Astra Linux
Google Chrome
Red Os
Suse