Fedora 34 update for qt5-qtwebengine

1) Use-after-free

EUVDB-ID: #VU53546

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30523

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the WebRTC component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds read

EUVDB-ID: #VU53553

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-30530

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a boundary condition within the WebAudio component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and crash the browser.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU53557

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-30534

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in iFrameSandbox in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Double Free

EUVDB-ID: #VU53573

Risk: Medium

CVSSv4.0: 4.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-30535

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within ICU component in Google Chrome. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger a double free error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

EUVDB-ID: #VU53999

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30544

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the BFCache component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Type Confusion

EUVDB-ID: #VU54006

Risk: Critical

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2021-30551

CWE-ID: CWE-843 - Type confusion

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

7) Use-after-free

EUVDB-ID: #VU54210

Risk: Critical

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2021-30554

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the WebGL component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

8) Use-after-free

EUVDB-ID: #VU53545

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30522

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the WebAudio component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Out-of-bounds read

EUVDB-ID: #VU53574

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-30536

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in V8 engine in Google Chrome. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU53556

Risk: Medium

CVSSv4.0: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:A/U:Green]

CVE-ID: CVE-2021-30533

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in PopupBlocker in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

11) Out-of-bounds write

EUVDB-ID: #VU54901

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30559

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in ANGLE. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Use-after-free

EUVDB-ID: #VU54212

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30556

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the WebAudio component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Out-of-bounds write

EUVDB-ID: #VU54002

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30547

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in ANGLE. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Use-after-free

EUVDB-ID: #VU54003

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30548

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Loader component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Use-after-free

EUVDB-ID: #VU54008

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-30553

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Network service in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Type Confusion

EUVDB-ID: #VU54906

Risk: Critical

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2021-30563

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

17) Use-after-free

EUVDB-ID: #VU54902

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30541

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Heap-based buffer overflow

EUVDB-ID: #VU55107

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30568

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in WebGL. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Use-after-free

EUVDB-ID: #VU55108

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30569

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the sqlite component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Use-after-free

EUVDB-ID: #VU55111

Risk: High

CVSSv4.0: 7.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2021-30573

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the GPU component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

21) Improperly implemented security check for standard

EUVDB-ID: #VU55125

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30587

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Compositing on Windows in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Type Confusion

EUVDB-ID: #VU55126

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-30588

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a type confusion error and crash the browser.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Type Confusion

EUVDB-ID: #VU55869

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30598

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in V8. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Type Confusion

EUVDB-ID: #VU55870

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30599

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in V8. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Use-after-free

EUVDB-ID: #VU55873

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30602

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in WebRTC. A remote attacker can trick the victim to visit a specially crafted web page, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Race condition

EUVDB-ID: #VU55874

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30603

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a race condition in WebAudio. A remote attacker can trick the victim to visit a specially crafted webpage and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Use-after-free

EUVDB-ID: #VU55875

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30604

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in ANGLE. A remote attacker can trick the victim to visit a specially crafted web page, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Use-after-free

EUVDB-ID: #VU55123

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-30585

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within sensor handling in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Stack-based buffer overflow

EUVDB-ID: #VU55105

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30566

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in Printing in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a stack-based buffer overflow and execute arbitrary code on the system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Use-after-free

EUVDB-ID: #VU54903

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30560

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Blink XSLT component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Improperly implemented security check for standard

EUVDB-ID: #VU56209

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30618

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Use-after-free

EUVDB-ID: #VU56205

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-30613

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Base internals in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Use-after-free

EUVDB-ID: #VU56476

Risk: High

CVSSv4.0: 7.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2021-30625

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Selection API component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

34) Buffer overflow

EUVDB-ID: #VU56486

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30626

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in ANGLE in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a stack-based buffer overflow and execute arbitrary code on the system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Type Confusion

EUVDB-ID: #VU56477

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30627

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the Blink layout component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Stack-based buffer overflow

EUVDB-ID: #VU56478

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30628

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in ANGLE in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a stack-based buffer overflow and execute arbitrary code on the system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Use-after-free

EUVDB-ID: #VU56479

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-30629

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Permissions component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Improperly implemented security check for standard

EUVDB-ID: #VU56480

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-30630

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in Blink in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Use-after-free

EUVDB-ID: #VU56483

Risk: Critical

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2021-30633

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Indexed DB API component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in-the-wild.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

40) Improperly implemented security check for standard

EUVDB-ID: #VU56784

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-37967

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Background Fetch API in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Improperly implemented security check for standard

EUVDB-ID: #VU56785

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-37968

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Background Fetch API in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Spoofing attack

EUVDB-ID: #VU56788

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-37971

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Web Browser UI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Use-after-free

EUVDB-ID: #VU56876

Risk: Critical

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2021-37973

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content within the Portals component in Google Chrome. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

44) Use-after-free

EUVDB-ID: #VU56779

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-37962

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Performance Manager in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Use-after-free

EUVDB-ID: #VU56207

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-30616

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Media in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Heap-based buffer overflow

EUVDB-ID: #VU57129

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-37978

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Blink. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Heap-based buffer overflow

EUVDB-ID: #VU57130

Risk: High

CVSSv4.0: 7.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2021-37979

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: Yes

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in WebRTC. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

48) Improperly implemented security check for standard

EUVDB-ID: #VU57131

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2021-37980

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: Yes

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in Sandbox in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

49) Use-after-free

EUVDB-ID: #VU56972

Risk: Critical

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2021-37975

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the V8 browser engine in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

50) Out-of-bounds read

EUVDB-ID: #VU56789

Risk: Low

CVSSv4.0: 0.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-37972

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing images within the libjpeg-turbo library. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Out-of-bounds write

EUVDB-ID: #VU54224

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-3517

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in the xml entity encoding functionality. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Input validation error

EUVDB-ID: #VU53289

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-3541

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Improperly implemented security check for standard

EUVDB-ID: #VU57765

Risk: Critical

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2021-38003

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: Yes

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in the V8 engine in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

Note, the vulnerability is being actively exploited in the wild.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

54) Use-after-free

EUVDB-ID: #VU57450

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-37987

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Network APIs in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Out-of-bounds read

EUVDB-ID: #VU57454

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-37992

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the WebAudio component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Heap-based buffer overflow

EUVDB-ID: #VU57447

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-37984

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in PDFium. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Use-after-free

EUVDB-ID: #VU57455

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-37993

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within PDF Accessibility in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Improperly implemented security check for standard

EUVDB-ID: #VU58168

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-38018

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in navigation in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Improperly implemented security check for standard

EUVDB-ID: #VU58165

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-38015

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in input in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Improperly implemented security check for standard

EUVDB-ID: #VU58157

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-38009

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in cache in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU58167

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-38017

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in iframe sandbox in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Type Confusion

EUVDB-ID: #VU58155

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-38007

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU58169

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-38019

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in CORS in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Use-after-free

EUVDB-ID: #VU58159

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-38005

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the loader component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Improperly implemented security check for standard

EUVDB-ID: #VU58171

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-38021

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in referrer in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Improperly implemented security check for standard

EUVDB-ID: #VU58160

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-38010

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in service workers in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Type Confusion

EUVDB-ID: #VU58162

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-38012

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a type confusion error and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Improperly implemented security check for standard

EUVDB-ID: #VU58172

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-38022

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in WebAuthentication in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Improperly implemented security check for standard

EUVDB-ID: #VU57452

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-37989

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Blink in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Type Confusion

EUVDB-ID: #VU57763

Risk: High

CVSSv4.0: 7.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2021-38001

CWE-ID: CWE-843 - Type confusion

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

71) Input validation error

EUVDB-ID: #VU57456

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-37996

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Downloads in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Use-after-free

EUVDB-ID: #VU58539

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-4057

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the file API component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Heap-based buffer overflow

EUVDB-ID: #VU58540

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-4058

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in ANGLE. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Input validation error

EUVDB-ID: #VU58541

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-4059

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper input validation in loader in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage and execute arbitrary code on the system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Heap-based buffer overflow

EUVDB-ID: #VU58543

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-4062

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in BFCache. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Out-of-bounds write

EUVDB-ID: #VU59667

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-4079

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in WebRTC. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger an out-of-bounds write error and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Type Confusion

EUVDB-ID: #VU59666

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-4078

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Input validation error

EUVDB-ID: #VU58846

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-4098

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when processing HTML content in Mojo. Chrome Critical. A remote attacker can trick the victim to open a specially crafted web page and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Use-after-free

EUVDB-ID: #VU58842

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-4099

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Swiftshader component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Heap-based buffer overflow

EUVDB-ID: #VU58844

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-4101

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Swiftshader. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Use-after-free

EUVDB-ID: #VU58845

Risk: Critical

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2021-4102

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the V8 engine. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Install updates from vendor's repository.

Fedora: 34

qt5-qtwebengine: before 5.15.8-2.fc34

• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:qt5-qtwebengine:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-2022-e39987b17d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.