ALT-BU-2023-5435-1
Branch p10 update bulletin.
Closed vulnerabilities
BDU:2023-04416
Уязвимость обработчика JavaScript-сценариев V8 браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2023-04417
Уязвимость обработчика JavaScript-сценариев V8 браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2023-04418
Уязвимость обработчика JavaScript-сценариев V8 браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2023-04489
Уязвимость компонента Visuals браузера Google Chrome, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
BDU:2023-04491
Уязвимость компонента Extensions (Расширения) браузера Google Chrome, позволяющая нарушителю проводить межсайтовые сценарные атаки
BDU:2023-04492
Уязвимость технологии WebRTC браузера Google Chrome, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
BDU:2023-04493
Уязвимость компонента Cast (Трансляция) браузера Google Chrome, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
BDU:2023-04494
Уязвимость планировщика задач Task Scheduling браузера Google Chrome, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
BDU:2023-04495
Уязвимость компонента Extensions (Расширения) браузера Google Chrome, позволяющая нарушителю проводить межсайтовые сценарные атаки
BDU:2023-04497
Уязвимость компонента WebGL браузера Google Chrome, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
BDU:2023-04846
Уязвимость запросов на получение разрешений сайтов (Permission Prompts) браузера Google Chrome, позволяющая нарушителю получить доступ к конфиденциальной информации
BDU:2023-04847
Уязвимость компонента Extensions API браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
BDU:2023-04851
Уязвимость компонента Network браузера Google Chrome, позволяющая нарушителю вызвать отказ в обслуживании или, возможно, оказать другое воздействие
BDU:2023-04853
Уязвимость реализации прикладного программного интерфейса Fullscreen браузера Google Chrome для Android, позволяющая нарушителю подделать содержимое омнибокса
BDU:2023-04854
Уязвимость средства запуска App Launcher браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
BDU:2023-04855
Уязвимость компонента Audio браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
BDU:2023-04856
Уязвимость DNS службы браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2023-04858
Уязвимость компонента Extensions API браузера Google Chrome, позволяющая нарушителю установить произвольное расширение
BDU:2023-04859
Уязвимость компонента Extensions API браузера Google Chrome, позволяющая нарушителю установить произвольное расширение
BDU:2023-04861
Уязвимость графической библиотеки Skia браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2023-04865
Уязвимость функции автозаполнения Autofill браузера Google Chrome для Android, позволяющая нарушителю обойти существующие ограничения безопасности
BDU:2023-04869
Уязвимость библиотеки ANGLE браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2023-04870
Уязвимость обработчика JavaScript-сценариев V8 браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2023-04871
Уязвимость обработчика JavaScript-сценариев V8 браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2023-04872
Уязвимость автономного режима браузера Google Chrome для Android, позволяющая нарушителю выполнить произвольный код
BDU:2023-04873
Уязвимость компонента Device Trust Connectors браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2023-04874
Уязвимость цвета фона браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
BDU:2023-04875
Уязвимость компонента XML браузера Google Chrome, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2023-04876
Уязвимость компонента Mojom IDL браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2023-04881
Уязвимость компонента WebShare браузера Google Chrome для Android, позволяющая нарушителю подделать содержимое адресной строки
BDU:2023-04882
Уязвимость реализации прикладного программного интерфейса Fullscreen браузера Google Chrome, позволяющая нарушителю подделать обойти существующие ограничения безопасности
Modified: 2024-11-21
CVE-2023-2312
Use after free in Offline in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1448548
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://www.debian.org/security/2023/dsa-5479
- https://security.gentoo.org/glsa/202401-34
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://crbug.com/1448548
Modified: 2024-11-21
CVE-2023-4068
Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://crbug.com/1466183
- https://crbug.com/1466183
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5467
- https://www.debian.org/security/2023/dsa-5467
Modified: 2024-11-21
CVE-2023-4069
Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://crbug.com/1465326
- https://crbug.com/1465326
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5467
- https://www.debian.org/security/2023/dsa-5467
Modified: 2024-11-21
CVE-2023-4070
Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://crbug.com/1462951
- https://crbug.com/1462951
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5467
- https://www.debian.org/security/2023/dsa-5467
Modified: 2024-11-21
CVE-2023-4071
Heap buffer overflow in Visuals in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://crbug.com/1458819
- https://crbug.com/1458819
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5467
- https://www.debian.org/security/2023/dsa-5467
Modified: 2024-11-21
CVE-2023-4072
Out of bounds read and write in WebGL in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://crbug.com/1464038
- https://crbug.com/1464038
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5467
- https://www.debian.org/security/2023/dsa-5467
Modified: 2024-11-21
CVE-2023-4074
Use after free in Blink Task Scheduling in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://crbug.com/1464113
- https://crbug.com/1464113
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5467
- https://www.debian.org/security/2023/dsa-5467
Modified: 2024-11-21
CVE-2023-4075
Use after free in Cast in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://crbug.com/1457757
- https://crbug.com/1457757
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5467
- https://www.debian.org/security/2023/dsa-5467
Modified: 2024-11-21
CVE-2023-4076
Use after free in WebRTC in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC session. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://crbug.com/1459124
- https://crbug.com/1459124
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5467
- https://www.debian.org/security/2023/dsa-5467
Modified: 2024-11-21
CVE-2023-4077
Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://crbug.com/1451146
- https://crbug.com/1451146
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5467
- https://www.debian.org/security/2023/dsa-5467
Modified: 2024-11-21
CVE-2023-4078
Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
- https://crbug.com/1461895
- https://crbug.com/1461895
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5467
- https://www.debian.org/security/2023/dsa-5467
Modified: 2024-11-21
CVE-2023-4349
Use after free in Device Trust Connectors in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1458303
- https://crbug.com/1458303
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2024-11-21
CVE-2023-4350
Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1454817
- https://crbug.com/1454817
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2024-11-21
CVE-2023-4351
Use after free in Network in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has elicited a browser shutdown to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1465833
- https://crbug.com/1465833
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2025-05-05
CVE-2023-4352
Type confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- http://packetstormsecurity.com/files/174669/Chrome-Read-Only-Property-Overwrite.html
- http://packetstormsecurity.com/files/174669/Chrome-Read-Only-Property-Overwrite.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1452076
- https://crbug.com/1452076
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2024-11-21
CVE-2023-4353
Heap buffer overflow in ANGLE in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1458046
- https://crbug.com/1458046
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2025-05-05
CVE-2023-4354
Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- http://packetstormsecurity.com/files/174949/Chrome-SKIA-Integer-Overflow.html
- http://packetstormsecurity.com/files/174949/Chrome-SKIA-Integer-Overflow.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1464215
- https://crbug.com/1464215
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2025-05-05
CVE-2023-4355
Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- http://packetstormsecurity.com/files/174950/Chrome-Dangling-FixedArray-Pointers-Memory-Corruption.html
- http://packetstormsecurity.com/files/174950/Chrome-Dangling-FixedArray-Pointers-Memory-Corruption.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1468943
- https://crbug.com/1468943
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2024-11-21
CVE-2023-4356
Use after free in Audio in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1449929
- https://crbug.com/1449929
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2024-11-21
CVE-2023-4357
Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1458911
- https://crbug.com/1458911
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2024-11-21
CVE-2023-4358
Use after free in DNS in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1466415
- https://crbug.com/1466415
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2024-11-21
CVE-2023-4359
Inappropriate implementation in App Launcher in Google Chrome on iOS prior to 116.0.5845.96 allowed a remote attacker to potentially spoof elements of the security UI via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1443722
- https://crbug.com/1443722
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2024-11-21
CVE-2023-4360
Inappropriate implementation in Color in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1462723
- https://crbug.com/1462723
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2024-11-21
CVE-2023-4361
Inappropriate implementation in Autofill in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1465230
- https://crbug.com/1465230
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2024-11-21
CVE-2023-4362
Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1316379
- https://crbug.com/1316379
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2024-11-21
CVE-2023-4363
Inappropriate implementation in WebShare in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to spoof the contents of a dialog URL via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1367085
- https://crbug.com/1367085
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2024-11-21
CVE-2023-4364
Inappropriate implementation in Permission Prompts in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1406922
- https://crbug.com/1406922
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2024-11-21
CVE-2023-4365
Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1431043
- https://crbug.com/1431043
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2024-11-21
CVE-2023-4366
Use after free in Extensions in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1450784
- https://crbug.com/1450784
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2024-11-21
CVE-2023-4367
Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1467743
- https://crbug.com/1467743
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479
Modified: 2024-11-21
CVE-2023-4368
Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
- https://crbug.com/1467751
- https://crbug.com/1467751
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5479
- https://www.debian.org/security/2023/dsa-5479