High WID-SEC-2022-1859 10 CVEs

Google Chrome/Microsoft Edge: Mehrere Schwachstellen

Published Oct 25, 2022 · Updated Jan 15, 2023 · Revision 5 · de-DE

Vendor: Debian Vendor: Google Vendor: Microsoft Product: Chrome Product: Chrome < 107.0.5304.62 (Mac) Product: Chrome < 107.0.5304.62/63 (Windows) Product: Chrome < 107.0.5304.68 (Linux) Product: Edge < 107.0.1418.24 Product: Linux Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Chrome/Microsoft Edge ausnutzen, um beliebigen Programmcode auszuführen und um einen Denial of Service Zustand herbeizuführen.

Product

Chrome ist ein Internet-Browser von Google.
Edge ist ein Browser vom Microsoft

Vulnerabilities 10

Unscored —

CVE-2022-3652

Type confusion in V8 in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit heap corr…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 1, 2022
Unscored —

CVE-2022-3653 Public exploit

Heap buffer overflow in Vulkan in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 1, 2022
Unscored —

CVE-2022-3654 EPSS 24%

Use after free in Layout in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit heap …

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 1, 2022
Unscored —

CVE-2022-3655

Heap buffer overflow in Media Galleries in Google Chrome prior to 107.0.5304.62 allowed an attacker who convinced a use…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 1, 2022
Unscored —

CVE-2022-3656 Public exploit

Insufficient data validation in File System in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 1, 2022
Unscored —

CVE-2022-3657

Use after free in Extensions in Google Chrome prior to 107.0.5304.62 allowed an attacker who convinced a user to instal…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 1, 2022
Unscored —

CVE-2022-3658

Use after free in Feedback service on Chrome OS in Google Chrome on Chrome OS prior to 107.0.5304.62 allowed an attacke…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 1, 2022
Unscored —

CVE-2022-3659

Use after free in Accessibility in Google Chrome on Chrome OS prior to 107.0.5304.62 allowed a remote attacker who conv…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 1, 2022
Unscored —

CVE-2022-3660

Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 107.0.5304.62 allowed a remote at…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 1, 2022
Unscored —

CVE-2022-3661

Insufficient data validation in Extensions in Google Chrome prior to 107.0.5304.62 allowed a remote attacker who had co…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 1, 2022

Revision history

2023-01-15 #5
Name "SymStealer" für CVE-2022-3656 ergänzt
2022-12-11 #4
PoC aufgenommen
2022-10-27 #3
Neue Updates aufgenommen
2022-10-26 #2
Neue Updates von Debian aufgenommen
2022-10-25 #1
Initiale Fassung

References

PoC auf bugs.chromium.org vom 2022-12-11
https://bugs.chromium.org/p/chromium/issues/detail?id=1352817
PoC auf bugs.chromium.org vom 2022-12-11
https://bugs.chromium.org/p/chromium/issues/detail?id=1327505
Chrome Stable Channel Update for Desktop vom 2022-10-25
https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html
Debian Security Advisory DSA-5261 vom 2022-10-26
https://lists.debian.org/debian-security-announce/2022/msg00231.html
Release notes for Microsoft Edge Security Updates
https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security