ALT-BU-2023-4875-2
Branch p10 update bulletin.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2022-41409
Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.
Package yandex-browser-stable updated to version 23.7.1.1216-alt1 for branch p10 in task 326709.
Closed vulnerabilities
BDU:2023-02350
Уязвимость реализации полноэкранного режима (Full Screen Mode) браузера Google Chrome, позволяющая нарушителю скрыть содержимое адресной строки Omnibox
BDU:2023-02367
Уязвимость реализации механизма CORS (Cross-Origin Resource Sharing) браузера Google Chrome, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2023-02380
Уязвимость расширений браузера Google Chrome, позволяющая нарушителю обойти ограничения безопасности и получить несанкционированный доступ к защищаемой информации
BDU:2023-02383
Уязвимость технологии Picture-in-Picture (PiP) браузера Google Chrome, позволяющая нарушителю проводить фишинг-атаки
BDU:2023-02384
Уязвимость компонента Prompts браузера Google Chrome операционных систем Android, позволяющая нарушителю обойти ограничения безопасности
BDU:2023-02385
Уязвимость компонента Prompts браузера Google Chrome, позволяющая нарушителю проводить фишинг-атаки
BDU:2023-02386
Уязвимость технологии Picture-in-Picture (PiP) браузера Google Chrome, позволяющая нарушителю проводить спуфинг-атаки
BDU:2023-02387
Уязвимость компонента Prompts браузера Google Chrome, позволяющая нарушителю проводить фишинг-атаки
BDU:2023-02388
Уязвимость расширения Google Input Tools Chrome OS браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2023-02389
Уязвимость компонента Prompts браузера Google Chrome, позволяющая нарушителю обойти ограничения безопасности
BDU:2023-02623
Уязвимость функции Navigation браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2023-02929
Уязвимость интерфейса автозаполнения Autofill браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2023-02930
Уязвимость режима Guest View браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2023-02955
Уязвимость библиотеки SwiftShader веб-браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2023-03080
Уязвимость обработчика JavaScript-сценариев V8 браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю выполнить произвольный код
BDU:2023-03442
Уязвимость обработчика JavaScript-сценариев V8 браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2023-03544
Уязвимость компонента WebApp Installs браузера Google Chrome, позволяющая нарушителю обойти ограничения безопасности
BDU:2023-03553
Уязвимость компонента Media браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2023-03628
Уязвимость компонента Guest View браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2023-03732
Уязвимость компонента Extensions API браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю установить произвольное расширение
BDU:2023-03733
Уязвимость установщика браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю повысить свои привилегии
BDU:2023-03804
Уязвимость обработчика JavaScript-сценариев V8 браузера Google Chrome, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2023-03805
Уязвимость набора инструментов для веб-разработки DevTools веб-браузера Google Chrome, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2023-03902
Уязвимость обработчика JavaScript-сценариев V8 браузера Google Chrome, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2023-03903
Уязвимость IPC-библиотеки Mojo браузера Google Chrome, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2023-03905
Уязвимость обработчика JavaScript-сценариев V8 браузера Google Chrome, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2023-03908
Уязвимость технологии Picture In Picture браузера Google Chrome, позволяющая нарушителю проводить фишинг-атаки
BDU:2023-03909
Уязвимость обработчика PDF-содержимого браузера Google Chrome, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2023-03915
Уязвимость технологии Picture In Picture браузера Google Chrome, позволяющая нарушителю проводить фишинг-атаки
BDU:2023-04050
Уязвимость загрузчика браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Modified: 2024-11-21
CVE-2023-2459
Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to bypass permission restrictions via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://crbug.com/1423304
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://security.gentoo.org/glsa/202309-17
- https://www.debian.org/security/2023/dsa-5398
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://www.debian.org/security/2023/dsa-5398
- https://security.gentoo.org/glsa/202309-17
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://crbug.com/1423304
Modified: 2024-11-21
CVE-2023-2460
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to bypass file access checks via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://crbug.com/1419732
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://security.gentoo.org/glsa/202309-17
- https://www.debian.org/security/2023/dsa-5398
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://www.debian.org/security/2023/dsa-5398
- https://security.gentoo.org/glsa/202309-17
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://crbug.com/1419732
Modified: 2024-11-21
CVE-2023-2461
Use after free in OS Inputs in Google Chrome on ChromeOS prior to 113.0.5672.63 allowed a remote attacker who convinced a user to enage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://crbug.com/1350561
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://security.gentoo.org/glsa/202309-17
- https://www.debian.org/security/2023/dsa-5398
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://www.debian.org/security/2023/dsa-5398
- https://security.gentoo.org/glsa/202309-17
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://crbug.com/1350561
Modified: 2024-11-21
CVE-2023-2462
Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to obfuscate main origin data via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://crbug.com/1375133
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://security.gentoo.org/glsa/202309-17
- https://www.debian.org/security/2023/dsa-5398
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://www.debian.org/security/2023/dsa-5398
- https://security.gentoo.org/glsa/202309-17
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://crbug.com/1375133
Modified: 2024-11-21
CVE-2023-2463
Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://crbug.com/1406120
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://security.gentoo.org/glsa/202309-17
- https://www.debian.org/security/2023/dsa-5398
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://www.debian.org/security/2023/dsa-5398
- https://security.gentoo.org/glsa/202309-17
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://crbug.com/1406120
Modified: 2024-11-21
CVE-2023-2464
Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to perform an origin spoof in the security UI via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://crbug.com/1418549
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://security.gentoo.org/glsa/202309-17
- https://www.debian.org/security/2023/dsa-5398
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://www.debian.org/security/2023/dsa-5398
- https://security.gentoo.org/glsa/202309-17
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://crbug.com/1418549
Modified: 2024-11-21
CVE-2023-2465
Inappropriate implementation in CORS in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://crbug.com/1399862
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://security.gentoo.org/glsa/202309-17
- https://www.debian.org/security/2023/dsa-5398
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://www.debian.org/security/2023/dsa-5398
- https://security.gentoo.org/glsa/202309-17
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://crbug.com/1399862
Modified: 2024-11-21
CVE-2023-2466
Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to spoof the contents of the security UI via a crafted HTML page. (Chromium security severity: Low)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://crbug.com/1385714
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://security.gentoo.org/glsa/202309-17
- https://www.debian.org/security/2023/dsa-5398
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://www.debian.org/security/2023/dsa-5398
- https://security.gentoo.org/glsa/202309-17
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://crbug.com/1385714
Modified: 2024-11-21
CVE-2023-2467
Inappropriate implementation in Prompts in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to bypass permissions restrictions via a crafted HTML page. (Chromium security severity: Low)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://crbug.com/1413586
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://security.gentoo.org/glsa/202309-17
- https://www.debian.org/security/2023/dsa-5398
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://www.debian.org/security/2023/dsa-5398
- https://security.gentoo.org/glsa/202309-17
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://crbug.com/1413586
Modified: 2024-11-21
CVE-2023-2468
Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who had compromised the renderer process to obfuscate the security UI via a crafted HTML page. (Chromium security severity: Low)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://crbug.com/1416380
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://security.gentoo.org/glsa/202309-17
- https://www.debian.org/security/2023/dsa-5398
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html
- https://www.debian.org/security/2023/dsa-5398
- https://security.gentoo.org/glsa/202309-17
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4JI552XDFD6DYFU6WNCRBCAXWOFOOSF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3V6GPGMY6ZWVWPECMQGGOKQVATXJ5BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6P5RJ6UD37IPBWU3GPQNMIUFVOVCGSLY/
- https://crbug.com/1416380
Modified: 2024-11-21
CVE-2023-2721
Use after free in Navigation in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html
- https://crbug.com/1444360
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/
- https://security.gentoo.org/glsa/202309-17
- https://security.gentoo.org/glsa/202311-11
- https://www.debian.org/security/2023/dsa-5404
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html
- https://www.debian.org/security/2023/dsa-5404
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202309-17
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/
- https://crbug.com/1444360
Modified: 2024-11-21
CVE-2023-2722
Use after free in Autofill UI in Google Chrome on Android prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html
- https://crbug.com/1400905
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/
- https://security.gentoo.org/glsa/202309-17
- https://security.gentoo.org/glsa/202311-11
- https://www.debian.org/security/2023/dsa-5404
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html
- https://www.debian.org/security/2023/dsa-5404
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202309-17
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/
- https://crbug.com/1400905
Modified: 2024-11-21
CVE-2023-2723
Use after free in DevTools in Google Chrome prior to 113.0.5672.126 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html
- https://crbug.com/1435166
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/
- https://security.gentoo.org/glsa/202309-17
- https://security.gentoo.org/glsa/202311-11
- https://www.debian.org/security/2023/dsa-5404
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html
- https://www.debian.org/security/2023/dsa-5404
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202309-17
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/
- https://crbug.com/1435166
Modified: 2024-11-21
CVE-2023-2724
Type confusion in V8 in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- http://packetstormsecurity.com/files/173131/Chrome-Internal-JavaScript-Object-Access-Via-Origin-Trials.html
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html
- https://crbug.com/1433211
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/
- https://security.gentoo.org/glsa/202309-17
- https://security.gentoo.org/glsa/202311-11
- https://www.debian.org/security/2023/dsa-5404
- http://packetstormsecurity.com/files/173131/Chrome-Internal-JavaScript-Object-Access-Via-Origin-Trials.html
- https://www.debian.org/security/2023/dsa-5404
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202309-17
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/
- https://crbug.com/1433211
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html
Modified: 2024-11-21
CVE-2023-2725
Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html
- https://crbug.com/1442516
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/
- https://security.gentoo.org/glsa/202309-17
- https://security.gentoo.org/glsa/202311-11
- https://www.debian.org/security/2023/dsa-5404
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html
- https://www.debian.org/security/2023/dsa-5404
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202309-17
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/
- https://crbug.com/1442516
Modified: 2024-11-21
CVE-2023-2726
Inappropriate implementation in WebApp Installs in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious web app to bypass install dialog via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html
- https://crbug.com/1442018
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/
- https://security.gentoo.org/glsa/202309-17
- https://security.gentoo.org/glsa/202311-11
- https://www.debian.org/security/2023/dsa-5404
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html
- https://www.debian.org/security/2023/dsa-5404
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202309-17
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/
- https://crbug.com/1442018
Modified: 2024-11-21
CVE-2023-2929
Out of bounds write in Swiftshader in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://crbug.com/1410191
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B6SAST6CB5KKCQKH75ER2UQ3ICYPHCIZ/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5418
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://www.debian.org/security/2023/dsa-5418
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202311-11
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B6SAST6CB5KKCQKH75ER2UQ3ICYPHCIZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
- https://crbug.com/1410191
Modified: 2024-11-21
CVE-2023-2930
Use after free in Extensions in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://crbug.com/1443401
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5418
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://www.debian.org/security/2023/dsa-5418
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202311-11
- https://crbug.com/1443401
Modified: 2024-11-21
CVE-2023-2931
Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://crbug.com/1444238
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5418
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://www.debian.org/security/2023/dsa-5418
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202311-11
- https://crbug.com/1444238
Modified: 2024-11-21
CVE-2023-2932
Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://crbug.com/1444581
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5418
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://www.debian.org/security/2023/dsa-5418
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202311-11
- https://crbug.com/1444581
Modified: 2024-11-21
CVE-2023-2933
Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://crbug.com/1445426
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5418
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://www.debian.org/security/2023/dsa-5418
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202311-11
- https://crbug.com/1445426
Modified: 2024-11-21
CVE-2023-2934
Out of bounds memory access in Mojo in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- http://packetstormsecurity.com/files/173259/Chrome-Mojo-Message-Validation-Bypass.html
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://crbug.com/1429720
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5418
- http://packetstormsecurity.com/files/173259/Chrome-Mojo-Message-Validation-Bypass.html
- https://www.debian.org/security/2023/dsa-5418
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202311-11
- https://crbug.com/1429720
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
Modified: 2024-11-21
CVE-2023-2935
Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- http://packetstormsecurity.com/files/173196/Chrome-v8-internal-Object-SetPropertyWithAccessor-Type-Confusion.html
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://crbug.com/1440695
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5418
- http://packetstormsecurity.com/files/173196/Chrome-v8-internal-Object-SetPropertyWithAccessor-Type-Confusion.html
- https://www.debian.org/security/2023/dsa-5418
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202311-11
- https://crbug.com/1440695
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
Modified: 2024-11-21
CVE-2023-2936
Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- http://packetstormsecurity.com/files/173197/Chrome-V8-Type-Confusion.html
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://crbug.com/1443452
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5418
- http://packetstormsecurity.com/files/173197/Chrome-V8-Type-Confusion.html
- https://www.debian.org/security/2023/dsa-5418
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202311-11
- https://crbug.com/1443452
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
Modified: 2025-03-11
CVE-2023-2937
Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://crbug.com/1413813
- https://crbug.com/1413813
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5418
- https://www.debian.org/security/2023/dsa-5418
Modified: 2025-03-18
CVE-2023-2938
Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://crbug.com/1416350
- https://crbug.com/1416350
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5418
- https://www.debian.org/security/2023/dsa-5418
Modified: 2024-11-21
CVE-2023-2939
Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege escalation via crafted symbolic link. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://crbug.com/1427431
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5418
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://www.debian.org/security/2023/dsa-5418
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202311-11
- https://crbug.com/1427431
Modified: 2025-03-12
CVE-2023-2940
Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://crbug.com/1426807
- https://crbug.com/1426807
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5418
- https://www.debian.org/security/2023/dsa-5418
Modified: 2025-03-11
CVE-2023-2941
Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to spoof the contents of the UI via a crafted Chrome Extension. (Chromium security severity: Low)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://crbug.com/1430269
- https://crbug.com/1430269
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5418
- https://www.debian.org/security/2023/dsa-5418
Modified: 2025-02-05
CVE-2023-3079
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- http://packetstormsecurity.com/files/176211/Chrome-V8-Type-Confusion.html
- http://packetstormsecurity.com/files/176211/Chrome-V8-Type-Confusion.html
- http://packetstormsecurity.com/files/176212/Chrome-V8-Type-Confusion-New-Sandbox-Escape.html
- http://packetstormsecurity.com/files/176212/Chrome-V8-Type-Confusion-New-Sandbox-Escape.html
- https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html
- https://crbug.com/1450481
- https://crbug.com/1450481
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DYTXO5E3FI3I2ETDP3HF4SHYYTFMKMIC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DYTXO5E3FI3I2ETDP3HF4SHYYTFMKMIC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4OXTNIZY4JYHJT7CVLPAJQILI6BISVM/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4OXTNIZY4JYHJT7CVLPAJQILI6BISVM/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.couchbase.com/alerts/
- https://www.couchbase.com/alerts/
- https://www.debian.org/security/2023/dsa-5420
- https://www.debian.org/security/2023/dsa-5420
Modified: 2024-11-21
CVE-2023-3420
Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html
- https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html
- https://crbug.com/1452137
- https://crbug.com/1452137
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KREKCQTJDVI2AEBG5ECZPSOQXIC2L5XL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KREKCQTJDVI2AEBG5ECZPSOQXIC2L5XL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBAHED5YFJPRGSEKNZIYHZBGSVHGEHOH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBAHED5YFJPRGSEKNZIYHZBGSVHGEHOH/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5440
- https://www.debian.org/security/2023/dsa-5440
Modified: 2024-11-21
CVE-2023-3421
Use after free in Media in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html
- https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html
- https://crbug.com/1447568
- https://crbug.com/1447568
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KREKCQTJDVI2AEBG5ECZPSOQXIC2L5XL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KREKCQTJDVI2AEBG5ECZPSOQXIC2L5XL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBAHED5YFJPRGSEKNZIYHZBGSVHGEHOH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBAHED5YFJPRGSEKNZIYHZBGSVHGEHOH/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5440
- https://www.debian.org/security/2023/dsa-5440
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1751
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1751
Modified: 2024-11-21
CVE-2023-3422
Use after free in Guest View in Google Chrome prior to 114.0.5735.198 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html
- https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html
- https://crbug.com/1450397
- https://crbug.com/1450397
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KREKCQTJDVI2AEBG5ECZPSOQXIC2L5XL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KREKCQTJDVI2AEBG5ECZPSOQXIC2L5XL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBAHED5YFJPRGSEKNZIYHZBGSVHGEHOH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBAHED5YFJPRGSEKNZIYHZBGSVHGEHOH/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5440
- https://www.debian.org/security/2023/dsa-5440
Modified: 2024-11-21
CVE-2023-3598
Out of bounds read and write in ANGLE in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html
- https://crbug.com/1427865
- https://crbug.com/1427865
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B6SAST6CB5KKCQKH75ER2UQ3ICYPHCIZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B6SAST6CB5KKCQKH75ER2UQ3ICYPHCIZ/
Package kernel-image-std-def updated to version 5.10.189-alt1 for branch p10 in task 326786.
Closed vulnerabilities
BDU:2023-04650
Уязвимость функции xenvif_get_requests() в модуле drivers/net/xen-netback/netback.c гипервизора xen ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на целостность, конфиденциальность и доступность защищаемой информации
Modified: 2025-02-13
CVE-2023-34319
The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire packet being split into as many pieces as permitted by the protocol, yet still being smaller than the area that's specially dealt with to keep all (possible) headers together. Such an unusual packet would therefore trigger a buffer overrun in the driver.
- http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html
- http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html
- https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
- https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
- https://security.netapp.com/advisory/ntap-20240202-0001/
- https://security.netapp.com/advisory/ntap-20240202-0001/
- https://xenbits.xenproject.org/xsa/advisory-432.html
- https://xenbits.xenproject.org/xsa/advisory-432.html