Gentoo update for Chromium, Google Chrome, Microsoft Edge
| Risk | Critical |
| Patch available | YES |
| Number of vulnerabilities | 18 |
| CVE-ID | CVE-2024-0333 CVE-2024-0517 CVE-2024-0518 CVE-2024-0519 CVE-2024-0804 CVE-2024-0805 CVE-2024-0806 CVE-2024-0807 CVE-2024-0808 CVE-2024-0809 CVE-2024-0810 CVE-2024-0811 CVE-2024-0812 CVE-2024-0813 CVE-2024-0814 CVE-2024-1059 CVE-2024-1060 CVE-2024-1077 |
| CWE-ID | CWE-20 CWE-787 CWE-843 CWE-119 CWE-264 CWE-358 CWE-416 CWE-191 CWE-451 |
| Exploitation vector | Network |
| Public exploit | Vulnerability #4 is being exploited in the wild. |
| Vulnerable software |
Gentoo Linux Operating systems & Components / Operating system www-client/microsoft-edge Operating systems & Components / Operating system package or component www-client/google-chrome Operating systems & Components / Operating system package or component www-client/chromium Operating systems & Components / Operating system package or component |
| Vendor | Gentoo |
Security Bulletin
This security bulletin contains information about 18 vulnerabilities.
1) Input validation error
EUVDB-ID: #VU85212
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2024-0333
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation when processing HTML content in Extensions. Chrome High. A remote attacker can trick the victim to open a specially crafted web page and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Out-of-bounds write
EUVDB-ID: #VU85444
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2024-0517
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted HTML content in V8. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Type Confusion
EUVDB-ID: #VU85445
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2024-0518
CWE-ID:
CWE-843 - Type confusion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Buffer overflow
EUVDB-ID: #VU85446
Risk: Critical
CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]
CVE-ID: CVE-2024-0519
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to a boundary error in V8 in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a stack-based buffer overflow and execute arbitrary code on the system.
Note, the vulnerability is being actively exploited in the wild.
Update the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
5) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU85731
Risk: Medium
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-0804
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient policy enforcement in iOS Security UI in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Improperly implemented security check for standard
EUVDB-ID: #VU85730
Risk: High
CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2024-0805
CWE-ID:
CWE-358 - Improperly Implemented Security Check for Standard
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to incorrect implementation in Downloads in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Use-after-free
EUVDB-ID: #VU85729
Risk: Medium
CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-0806
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within Passwords in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Use-after-free
EUVDB-ID: #VU85723
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2024-0807
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the WebAudio component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Integer underflow
EUVDB-ID: #VU85725
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2024-0808
CWE-ID:
CWE-191 - Integer underflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer underflow in WebUI. A remote attacker can trick the victim to open a specially crafted web page, trigger integer underflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Improperly implemented security check for standard
EUVDB-ID: #VU85733
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-0809
CWE-ID:
CWE-358 - Improperly Implemented Security Check for Standard
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to incorrect implementation in Autofill in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU85726
Risk: Medium
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-0810
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient policy enforcement in DevTools in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Improperly implemented security check for standard
EUVDB-ID: #VU85732
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-0811
CWE-ID:
CWE-358 - Improperly Implemented Security Check for Standard
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to incorrect implementation in Extensions API in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
13) Improperly implemented security check for standard
EUVDB-ID: #VU85724
Risk: Medium
CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-0812
CWE-ID:
CWE-358 - Improperly Implemented Security Check for Standard
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to incorrect implementation in Accessibility in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
14) Use-after-free
EUVDB-ID: #VU85728
Risk: Medium
CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-0813
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within Reading Mode in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
15) Spoofing attack
EUVDB-ID: #VU85727
Risk: Medium
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-0814
CWE-ID:
CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a spoofing attack.
The vulnerability exists due to insufficient validation of user-supplied input in Payments in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
16) Use-after-free
EUVDB-ID: #VU85915
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2024-1059
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the WebRTC component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
17) Use-after-free
EUVDB-ID: #VU85914
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2024-1060
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the Canvas component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
18) Use-after-free
EUVDB-ID: #VU85916
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2024-1077
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the Network component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationUpdate the affected packages.
www-client/chromium to version: 121.0.6167.139
www-client/google-chrome to version: 121.0.6167.139
www-client/microsoft-edge to version: 121.0.2277.83
Gentoo Linux: All versions
www-client/microsoft-edge: before 121.0.2277.83
www-client/google-chrome: before 121.0.6167.139
www-client/chromium: before 121.0.6167.139
CPE2.3- cpe:2.3:o:gentoo:gentoo_linux:*:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:www-client_microsoft-edge:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_google-chrome:*:*:*:*:*:gentoo_linux:*:*
- cpe:2.3:o:gentoo:www-client_chromium:*:*:*:*:*:gentoo_linux:*:*
https://security.gentoo.org/glsa/202402-23
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
