SB2022072302 - Multiple vulnerabilities in Microsoft Edge

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2022-2477)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in Guest View when processing HTML content. A remote attacker can trick the victim to visit a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

2) Use-after-free (CVE-ID: CVE-2022-2478)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in PDF component. A remote attacker can trick the victim to visit a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

3) Input validation error (CVE-ID: CVE-2022-2479)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in File component. A remote attacker can trick the victim to visit a specially crafted website and execute arbitrary code on the system.

4) Use-after-free (CVE-ID: CVE-2022-2480)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in Service Worker API when processing HTML content. A remote attacker can trick the victim to visit a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

5) Use-after-free (CVE-ID: CVE-2022-2481)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in Views when processing HTML content. A remote attacker can trick the victim to visit a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Remediation

Install update from vendor's website.

References

• https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html
• https://crbug.com/1336266
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-2477
• https://crbug.com/1335861
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-2478
• https://crbug.com/1329987
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-2479
• https://crbug.com/1339844
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-2480
• https://crbug.com/1341603
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-2481