ALT-PU-2023-8219-3
Package yandex-browser-stable updated to version 23.11.1.802-alt2 for branch sisyphus in task 336400.
Closed vulnerabilities
Published: 2023-09-11
BDU:2023-05510
Уязвимость библиотеки libwebp для кодирования и декодирования изображений в формате WebP, связанная с чтением за границами буфера в памяти, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
Published: 2023-09-13
BDU:2023-06027
Уязвимость пользовательских вкладок браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Severity: MEDIUM (4.3)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
Published: 2023-09-12
BDU:2023-06106
Уязвимость компонента Prompts браузера Google Chrome, позволяющая нарушителю проводить спуфинг-атаки
Severity: MEDIUM (4.3)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
Published: 2023-09-13
BDU:2023-06107
Уязвимость компонента Input браузера Google Chrome, позволяющая нарушителю подменить пользовательский интерфейс
Severity: MEDIUM (4.3)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
Published: 2023-09-13
BDU:2023-06108
Уязвимость пользовательских вкладок браузера Google Chrome, позволяющая нарушителю подменить пользовательский интерфейс
Severity: MEDIUM (4.3)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
Published: 2023-09-13
BDU:2023-06132
Уязвимость компонента Prompts браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Severity: MEDIUM (4.3)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
Published: 2023-09-13
BDU:2023-06133
Уязвимость компонента Downloads браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Severity: MEDIUM (4.3)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
Published: 2023-09-13
BDU:2023-06134
Уязвимость функции автозаполнения Autofill браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Severity: MEDIUM (4.3)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
Published: 2023-09-13
BDU:2023-06135
Уязвимость компонента Intents браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Severity: MEDIUM (4.3)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
Published: 2023-09-13
BDU:2023-06136
Уязвимость технологии Picture In Picture браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Severity: MEDIUM (4.3)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
Published: 2023-09-13
BDU:2023-06137
Уязвимость компонента Interstitials браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Severity: MEDIUM (4.3)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
Published: 2023-09-28
BDU:2023-06157
Уязвимость функции кодирования в формат VP8 библиотеки libvpx браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
Severity: CRITICAL (9.6)
Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References:
Published: 2023-09-28
BDU:2023-06298
Уязвимость компонента Passwords (управление паролями) браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
Published: 2023-09-28
BDU:2023-06299
Уязвимость компонента Extensions (Расширения) браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
Published: 2023-10-03
BDU:2023-06341
Уязвимость обработчика JavaScript-сценариев V8 браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
Published: 2023-10-10
BDU:2023-06604
Уязвимость компонента Site Isolation браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
Published: 2023-10-10
BDU:2023-06605
Уязвимость функции автозаполнения Autofill браузера Google Chrome, позволяющая нарушителю раскрыть защищаемую информацию
Severity: MEDIUM (6.5)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References:
Published: 2023-10-10
BDU:2023-06606
Уязвимость компонента Navigation браузера Google Chrome, позволяющая нарушителю проводить спуфинг-атаки
Severity: MEDIUM (6.5)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
Published: 2023-10-10
BDU:2023-06607
Уязвимость компонента Installer браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Severity: MEDIUM (4.3)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
Published: 2023-10-10
BDU:2023-06608
Уязвимость компонента Input браузера Google Chrome, позволяющая нарушителю проводить спуфинг-атаки
Severity: MEDIUM (4.3)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
Published: 2023-10-10
BDU:2023-06611
Уязвимость компонента Cast браузера Google Chrome, позволяющая нарушителю скомпрометировать процесс рендеринга
Severity: MEDIUM (6.3)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
References:
Published: 2023-10-10
BDU:2023-06669
Уязвимость функции автозаполнения Autofill браузера Google Chrome, позволяющая нарушителю оказать влияние на целостность защищаемой информации
Severity: MEDIUM (4.3)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
Published: 2023-10-10
BDU:2023-06670
Уязвимость компонента Downloads (Загрузки) браузера Google Chrome, позволяющая нарушителю проводить спуфинг атаки
Severity: MEDIUM (6.5)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
Published: 2023-10-10
BDU:2023-06671
Уязвимость реализации полноэкранного режима браузера Google Chrome, позволяющая нарушителю оказать влияние на целостность защищаемой информации
Severity: MEDIUM (6.5)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
Published: 2023-10-10
BDU:2023-06780
Уязвимость компонента PDFium браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
Published: 2023-10-10
BDU:2023-06823
Уязвимость компонента Blink History браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
Published: 2023-10-10
BDU:2023-06824
Уязвимость набора инструментов для веб-разработки DevTools браузеров Microsoft Edge и Google Chrome, позволяющая нарушителю выполнить произвольный код
Severity: MEDIUM (6.5)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
Published: 2023-10-10
BDU:2023-06825
Уязвимость компонента Extensions API браузеров Microsoft Edge и Google Chrome, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Severity: MEDIUM (6.5)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
Published: 2023-10-10
BDU:2023-06826
Уязвимость функции Intents браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения доступа
Severity: MEDIUM (6.5)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
Published: 2023-10-10
BDU:2023-07287
Уязвимость компонента Profiles браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
Severity: HIGH (8.8)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
Published: 2023-09-12
Modified: 2025-03-13
Modified: 2025-03-13
CVE-2023-4863
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
Severity: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- http://www.openwall.com/lists/oss-security/2023/09/21/4
- http://www.openwall.com/lists/oss-security/2023/09/21/4
- http://www.openwall.com/lists/oss-security/2023/09/22/1
- http://www.openwall.com/lists/oss-security/2023/09/22/1
- http://www.openwall.com/lists/oss-security/2023/09/22/3
- http://www.openwall.com/lists/oss-security/2023/09/22/3
- http://www.openwall.com/lists/oss-security/2023/09/22/4
- http://www.openwall.com/lists/oss-security/2023/09/22/4
- http://www.openwall.com/lists/oss-security/2023/09/22/5
- http://www.openwall.com/lists/oss-security/2023/09/22/5
- http://www.openwall.com/lists/oss-security/2023/09/22/6
- http://www.openwall.com/lists/oss-security/2023/09/22/6
- http://www.openwall.com/lists/oss-security/2023/09/22/7
- http://www.openwall.com/lists/oss-security/2023/09/22/7
- http://www.openwall.com/lists/oss-security/2023/09/22/8
- http://www.openwall.com/lists/oss-security/2023/09/22/8
- http://www.openwall.com/lists/oss-security/2023/09/26/1
- http://www.openwall.com/lists/oss-security/2023/09/26/1
- http://www.openwall.com/lists/oss-security/2023/09/26/7
- http://www.openwall.com/lists/oss-security/2023/09/26/7
- http://www.openwall.com/lists/oss-security/2023/09/28/1
- http://www.openwall.com/lists/oss-security/2023/09/28/1
- http://www.openwall.com/lists/oss-security/2023/09/28/2
- http://www.openwall.com/lists/oss-security/2023/09/28/2
- http://www.openwall.com/lists/oss-security/2023/09/28/4
- http://www.openwall.com/lists/oss-security/2023/09/28/4
- https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
- https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
- https://blog.isosceles.com/the-webp-0day/
- https://blog.isosceles.com/the-webp-0day/
- https://bugzilla.suse.com/show_bug.cgi?id=1215231
- https://bugzilla.suse.com/show_bug.cgi?id=1215231
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
- https://crbug.com/1479274
- https://crbug.com/1479274
- https://en.bandisoft.com/honeyview/history/
- https://en.bandisoft.com/honeyview/history/
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
- https://github.com/webmproject/libwebp/releases/tag/v1.3.2
- https://github.com/webmproject/libwebp/releases/tag/v1.3.2
- https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
- https://news.ycombinator.com/item?id=37478403
- https://news.ycombinator.com/item?id=37478403
- https://security.gentoo.org/glsa/202309-05
- https://security.gentoo.org/glsa/202309-05
- https://security.gentoo.org/glsa/202401-10
- https://security.gentoo.org/glsa/202401-10
- https://security.netapp.com/advisory/ntap-20230929-0011/
- https://security.netapp.com/advisory/ntap-20230929-0011/
- https://security-tracker.debian.org/tracker/CVE-2023-4863
- https://security-tracker.debian.org/tracker/CVE-2023-4863
- https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
- https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
- https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
- https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
- https://www.bentley.com/advisories/be-2023-0001/
- https://www.bentley.com/advisories/be-2023-0001/
- https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/
- https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/
- https://www.debian.org/security/2023/dsa-5496
- https://www.debian.org/security/2023/dsa-5496
- https://www.debian.org/security/2023/dsa-5497
- https://www.debian.org/security/2023/dsa-5497
- https://www.debian.org/security/2023/dsa-5498
- https://www.debian.org/security/2023/dsa-5498
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
- https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863
Published: 2023-09-13
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4900
Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate a permission prompt via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1430867
- https://crbug.com/1430867
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-13
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4901
Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1459281
- https://crbug.com/1459281
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-13
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4902
Inappropriate implementation in Input in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1454515
- https://crbug.com/1454515
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-13
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4903
Inappropriate implementation in Custom Mobile Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1446709
- https://crbug.com/1446709
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-13
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4904
Insufficient policy enforcement in Downloads in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Enterprise policy restrictions via a crafted download. (Chromium security severity: Medium)
Severity: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1453501
- https://crbug.com/1453501
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-13
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4905
Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1441228
- https://crbug.com/1441228
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-13
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4906
Insufficient policy enforcement in Autofill in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low)
Severity: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1449874
- https://crbug.com/1449874
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-13
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4907
Inappropriate implementation in Intents in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)
Severity: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1462104
- https://crbug.com/1462104
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-13
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4908
Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low)
Severity: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1451543
- https://crbug.com/1451543
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-13
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-4909
Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)
Severity: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html
- https://crbug.com/1463293
- https://crbug.com/1463293
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5499
- https://www.debian.org/security/2023/dsa-5499
Published: 2023-09-28
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5186
Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: High)
Severity: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- https://crbug.com/1478889
- https://crbug.com/1478889
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5508
- https://www.debian.org/security/2023/dsa-5508
Published: 2023-09-28
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5187
Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- https://crbug.com/1475798
- https://crbug.com/1475798
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5508
- https://www.debian.org/security/2023/dsa-5508
Published: 2023-09-28
Modified: 2025-04-03
Modified: 2025-04-03
CVE-2023-5217
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- http://seclists.org/fulldisclosure/2023/Oct/12
- http://seclists.org/fulldisclosure/2023/Oct/12
- http://seclists.org/fulldisclosure/2023/Oct/16
- http://seclists.org/fulldisclosure/2023/Oct/16
- http://www.openwall.com/lists/oss-security/2023/09/28/5
- http://www.openwall.com/lists/oss-security/2023/09/28/5
- http://www.openwall.com/lists/oss-security/2023/09/28/6
- http://www.openwall.com/lists/oss-security/2023/09/28/6
- http://www.openwall.com/lists/oss-security/2023/09/29/1
- http://www.openwall.com/lists/oss-security/2023/09/29/1
- http://www.openwall.com/lists/oss-security/2023/09/29/11
- http://www.openwall.com/lists/oss-security/2023/09/29/11
- http://www.openwall.com/lists/oss-security/2023/09/29/12
- http://www.openwall.com/lists/oss-security/2023/09/29/12
- http://www.openwall.com/lists/oss-security/2023/09/29/14
- http://www.openwall.com/lists/oss-security/2023/09/29/14
- http://www.openwall.com/lists/oss-security/2023/09/29/2
- http://www.openwall.com/lists/oss-security/2023/09/29/2
- http://www.openwall.com/lists/oss-security/2023/09/29/7
- http://www.openwall.com/lists/oss-security/2023/09/29/7
- http://www.openwall.com/lists/oss-security/2023/09/29/9
- http://www.openwall.com/lists/oss-security/2023/09/29/9
- http://www.openwall.com/lists/oss-security/2023/09/30/1
- http://www.openwall.com/lists/oss-security/2023/09/30/1
- http://www.openwall.com/lists/oss-security/2023/09/30/2
- http://www.openwall.com/lists/oss-security/2023/09/30/2
- http://www.openwall.com/lists/oss-security/2023/09/30/3
- http://www.openwall.com/lists/oss-security/2023/09/30/3
- http://www.openwall.com/lists/oss-security/2023/09/30/4
- http://www.openwall.com/lists/oss-security/2023/09/30/4
- http://www.openwall.com/lists/oss-security/2023/09/30/5
- http://www.openwall.com/lists/oss-security/2023/09/30/5
- http://www.openwall.com/lists/oss-security/2023/10/01/1
- http://www.openwall.com/lists/oss-security/2023/10/01/1
- http://www.openwall.com/lists/oss-security/2023/10/01/2
- http://www.openwall.com/lists/oss-security/2023/10/01/2
- http://www.openwall.com/lists/oss-security/2023/10/01/5
- http://www.openwall.com/lists/oss-security/2023/10/01/5
- http://www.openwall.com/lists/oss-security/2023/10/02/6
- http://www.openwall.com/lists/oss-security/2023/10/02/6
- http://www.openwall.com/lists/oss-security/2023/10/03/11
- http://www.openwall.com/lists/oss-security/2023/10/03/11
- https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/
- https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/
- https://bugzilla.redhat.com/show_bug.cgi?id=2241191
- https://bugzilla.redhat.com/show_bug.cgi?id=2241191
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- https://crbug.com/1486441
- https://crbug.com/1486441
- https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
- https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
- https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282
- https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282
- https://github.com/webmproject/libvpx/releases/tag/v1.13.1
- https://github.com/webmproject/libvpx/releases/tag/v1.13.1
- https://github.com/webmproject/libvpx/tags
- https://github.com/webmproject/libvpx/tags
- https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- https://pastebin.com/TdkC4pDv
- https://pastebin.com/TdkC4pDv
- https://security.gentoo.org/glsa/202310-04
- https://security.gentoo.org/glsa/202310-04
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://security-tracker.debian.org/tracker/CVE-2023-5217
- https://security-tracker.debian.org/tracker/CVE-2023-5217
- https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/
- https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/
- https://support.apple.com/kb/HT213961
- https://support.apple.com/kb/HT213961
- https://support.apple.com/kb/HT213972
- https://support.apple.com/kb/HT213972
- https://twitter.com/maddiestone/status/1707163313711497266
- https://twitter.com/maddiestone/status/1707163313711497266
- https://www.debian.org/security/2023/dsa-5508
- https://www.debian.org/security/2023/dsa-5508
- https://www.debian.org/security/2023/dsa-5509
- https://www.debian.org/security/2023/dsa-5509
- https://www.debian.org/security/2023/dsa-5510
- https://www.debian.org/security/2023/dsa-5510
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/
- https://www.openwall.com/lists/oss-security/2023/09/28/5
- https://www.openwall.com/lists/oss-security/2023/09/28/5
Published: 2023-10-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5218
Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Severity: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1487110
- https://crbug.com/1487110
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-05
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5346
Type confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop.html
- https://crbug.com/1485829
- https://crbug.com/1485829
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BMFDRMWMT6ZBLGLLWSWHHRAUBOSUXQDR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BMFDRMWMT6ZBLGLLWSWHHRAUBOSUXQDR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RA6HMWNOYQ56R35MHW77GVW7373Z4RSN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RA6HMWNOYQ56R35MHW77GVW7373Z4RSN/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
Published: 2023-10-25
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5472
Use after free in Profiles in Google Chrome prior to 118.0.5993.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_24.html
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_24.html
- https://crbug.com/1491296
- https://crbug.com/1491296
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5TWIUD4VIISLZWEQ4WLWFZT34T3KOXZB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5TWIUD4VIISLZWEQ4WLWFZT34T3KOXZB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RA6HMWNOYQ56R35MHW77GVW7373Z4RSN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RA6HMWNOYQ56R35MHW77GVW7373Z4RSN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDMQG42VVOZ5USSI4NSNT3VJPGBPNSIW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDMQG42VVOZ5USSI4NSNT3VJPGBPNSIW/
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5536
- https://www.debian.org/security/2023/dsa-5536
Published: 2023-10-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5473
Use after free in Cast in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
Severity: MEDIUM (6.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1484000
- https://crbug.com/1484000
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5474
Heap buffer overflow in PDF in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium)
Severity: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1483194
- https://crbug.com/1483194
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5475
Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. (Chromium security severity: Medium)
Severity: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1476952
- https://crbug.com/1476952
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5476
Use after free in Blink History in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Severity: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1474253
- https://crbug.com/1474253
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5477
Inappropriate implementation in Installer in Google Chrome prior to 118.0.5993.70 allowed a local attacker to bypass discretionary access control via a crafted command. (Chromium security severity: Low)
Severity: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1472558
- https://crbug.com/1472558
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5478
Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Severity: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1472404
- https://crbug.com/1472404
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5479
Inappropriate implementation in Extensions API in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1471253
- https://crbug.com/1471253
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5481
Inappropriate implementation in Downloads in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1458934
- https://crbug.com/1458934
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5483
Inappropriate implementation in Intents in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1425355
- https://crbug.com/1425355
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5484
Inappropriate implementation in Navigation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1414936
- https://crbug.com/1414936
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5485
Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass autofill restrictions via a crafted HTML page. (Chromium security severity: Low)
Severity: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1395164
- https://crbug.com/1395164
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5486
Inappropriate implementation in Input in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low)
Severity: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1357442
- https://crbug.com/1357442
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://www.debian.org/security/2023/dsa-5526
Published: 2023-10-12
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-5487
Inappropriate implementation in Fullscreen in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)
Severity: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html
- https://crbug.com/1062251
- https://crbug.com/1062251
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202311-11
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202312-07
- https://security.gentoo.org/glsa/202401-34
- https://security.gentoo.org/glsa/202401-34
- https://www.debian.org/security/2023/dsa-5526
- https://www.debian.org/security/2023/dsa-5526