SB2024032507 - Multiple vulnerabilities in Microsoft Edge

Description

This security bulletin contains information about 8 secuirty vulnerabilities.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2024-2625)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper control of object lifetime in V8 in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a stack-based buffer overflow and execute arbitrary code on the system.

2) Universal cross-site scripting (CVE-ID: CVE-2024-26247)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

3) Use-after-free (CVE-ID: CVE-2024-2627)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Canvas in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

4) Improperly implemented security check for standard (CVE-ID: CVE-2024-2631)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

5) Out-of-bounds read (CVE-ID: CVE-2024-2626)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Swiftshader component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

6) Improperly implemented security check for standard (CVE-ID: CVE-2024-2628)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Downloads in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

7) Spoofing attack (CVE-ID: CVE-2024-2629)

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

8) Improperly implemented security check for standard (CVE-ID: CVE-2024-2630)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Remediation

Install update from vendor's website.

References

• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-2625
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26247
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-2627
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-2631
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-2626
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-2628
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-2629
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-2630