High WID-SEC-2023-0062 14 CVEs

Google Chrome und Microsoft Edge: Mehrere Schwachstellen

Published Jan 10, 2023 · Updated Nov 26, 2023 · Revision 4 · de-DE

Vendor: Debian Vendor: gentoo Vendor: Google Vendor: Microsoft Product: Chrome Product: Chrome Linux < 109.0.5414.74 Product: Chrome Mac < 109.0.5414.87 Product: Chrome Windows < 109.0.5414.74 Product: Chrome Windows < 109.0.5414.75 Product: Edge Product: Edge < 109.0.1518.49 Product: Linux Product: Linux Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Chrome und Microsoft Edge ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszulösen.

Product

Chrome ist ein Internet-Browser von Google.
Edge ist ein Web Browser von Microsoft.

Vulnerabilities 14

High 8.8

CVE-2023-0128

Use after free in Overview Mode in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed a remote attacker who conv…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Jan 10, 2023
High 8.8

CVE-2023-0129

Heap buffer overflow in Network Service in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a use…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Jan 10, 2023
High 8.8

CVE-2023-0134

Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a ma…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Jan 10, 2023
High 8.8

CVE-2023-0135

Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a ma…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Jan 10, 2023
High 8.8

CVE-2023-0136

Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote a…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Jan 10, 2023
High 8.8

CVE-2023-0137

Heap buffer overflow in Platform Apps in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed an attacker who conv…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Jan 10, 2023
High 8.8

CVE-2023-0138

Heap buffer overflow in libphonenumber in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to potentially…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Jan 10, 2023
Medium 6.5

CVE-2023-0130

Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote a…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Jan 10, 2023
Medium 6.5

CVE-2023-0131

Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to …

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Jan 10, 2023
Medium 6.5

CVE-2023-0132

Inappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remo…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Jan 10, 2023
Medium 6.5

CVE-2023-0133

Inappropriate implementation in in Permission prompts in Google Chrome on Android prior to 109.0.5414.74 allowed a remo…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Jan 10, 2023
Medium 4.3

CVE-2023-0141

Insufficient policy enforcement in CORS in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to leak cross…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Jan 10, 2023
Unscored —

CVE-2023-0139

Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 109.0.5414.74 allowed a re…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Jan 10, 2023
Unscored —

CVE-2023-0140

Inappropriate implementation in in File System API in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote …

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Jan 10, 2023

Revision history

2023-11-26 #4
Neue Updates von Gentoo aufgenommen
2023-01-15 #3
Neue Updates von Debian aufgenommen
2023-01-12 #2
Neue Updates von Microsoft aufgenommen
2023-01-10 #1
Initiale Fassung

References

Gentoo Linux Security Advisory GLSA-202311-11 vom 2023-11-25
https://security.gentoo.org/glsa/202311-11
Google Chrome Stable Channel Release vom 2023-01-10
https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html
Release notes for Microsoft Edge Security Updates vom 2023-01-10
https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security
Microsoft Leitfaden für Sicherheitsupdates vom 2023-01-12
https://msrc.microsoft.com/update-guide
Debian Security Advisory DSA-5317 vom 2023-01-14
https://www.debian.org/security/2023/dsa-5317