Summary
Google heeft kwetsbaarheden verholpen in Chrome en Chromium.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken of code uit te voeren in de browser van het slachtoffer en daarmee mogelijk toegang krijgen tot gevoelige gegevens in de context van de browser van het slachtoffer.
Google meldt berichten te hebben ontvangen dat de kwetsbaarheid met kenmerk CVE-2024-7971 beperkt en gericht wordt misbruikt. Publieke Proof-of-Concept-code (PoC) of een publieke exploit is (nog) niet beschikbaar.
Oplossingen
Google heeft updates uitgebracht om de kwetsbaarheden te verhelpen in Chrome en Chromium 128.0.6613.84 en 128.0.6613.85.
Microsoft heeft out of band updates uitgebracht om de kwetsbaarheden te verhelpen in Edge 128.0.2739.42.
Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 20
-
High 8.8
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exp…
KEV Aug 28, 2024 -
High 8.8
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a…
KEV Aug 26, 2024 -
High 8.8
Use after free in Passwords in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to potentially…
-
High 8.8CVE-2024-7966 Public exploit
Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromis…
-
High 8.8
Heap buffer overflow in Fonts in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit …
-
High 8.8
Use after free in Autofill in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had convinced the user…
-
High 8.8
Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap cor…
-
High 8.8
Heap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform an out of b…
-
High 8.8
Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially…
-
High 8.1
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially per…
-
High 7.8
Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker t…
-
High 7.3
Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker t…
-
High 7.0
Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker t…
-
Medium 4.3
Inappropriate implementation in Permissions in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perfor…
-
Medium 4.3
Inappropriate implementation in FedCM in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI s…
-
Medium 4.3
Insufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who …
-
Medium 4.3
Inappropriate implementation in Views in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI s…
-
Medium 4.3
Inappropriate implementation in WebApp Installs in Google Chrome on Windows prior to 128.0.6613.84 allowed an attacker …
-
Medium 4.3
Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacke…
-
Medium 4.3
Inappropriate implementation in Extensions in Google Chrome on Windows prior to 128.0.6613.84 allowed a remote attacker…
Revision history
-
#1
Micrososft heeft de kwetsbaarheden verholpen in Edge
-
#0
Initiele versie
References
-
Source - chrome
https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html
-
Reference - hkcert
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-7971