Fedora EPEL 8 update for chromium

1) Type Confusion

EUVDB-ID: #VU89571

Risk: Critical

CVSSv3.1: 8.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2024-4947

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Use-after-free

EUVDB-ID: #VU89572

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-4948

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Dawn component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU89573

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-4949

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within V8 in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improperly implemented security check for standard

EUVDB-ID: #VU89574

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-4950

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Downloads in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

EUVDB-ID: #VU89324

Risk: Critical

CVSSv3.1: 8.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2024-4671

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Visuals component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

6) Use-after-free

EUVDB-ID: #VU89232

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-4558

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the ANGLE component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Heap-based buffer overflow

EUVDB-ID: #VU89233

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-4559

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in WebAudio. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use-after-free

EUVDB-ID: #VU89079

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-4331

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Picture In Picture component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use-after-free

EUVDB-ID: #VU89080

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-4368

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Dawn component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Heap-based buffer overflow

EUVDB-ID: #VU89298

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-49528

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the in the de_stereo component in af_dialoguenhance.c. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Use-after-free

EUVDB-ID: #VU89299

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-31578

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the av_hwframe_ctx_init() function. A remote attacker can pass specially crated input to the application, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Improper Validation of Array Index

EUVDB-ID: #VU89300

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-31581

CWE-ID: CWE-129 - Improper Validation of Array Index

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the in the  libavcodec/cbs_h266_syntax_template.c. A remote attacker can pass specially crafted data to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Heap-based buffer overflow

EUVDB-ID: #VU89301

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-31582

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the raw_block_rectangle() function of libavfilter/vf_codecview.c.. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Off-by-one

EUVDB-ID: #VU89302

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-31585

CWE-ID: CWE-193 - Off-by-one Error

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an off-by-one error in libavfilter/avf_showspectrum.c. A remote attacker can trigger an off-by-one error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Buffer overflow

EUVDB-ID: #VU89303

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-49501

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in config_eq_output function in the libavfilter/asrc_afirsrc.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Buffer overflow

EUVDB-ID: #VU89304

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-49502

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in ff_bwdif_filter_intra_c() function in the libavfilter/bwdifdsp.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Buffer overflow

EUVDB-ID: #VU89305

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51791

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in gen_alias_map() function in the libavcodec/jpegxl_parser.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Buffer overflow

EUVDB-ID: #VU89313

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51792

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error. A remote attacker can pass specially crafted input to the application, trigger memory corruption and perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Buffer overflow

EUVDB-ID: #VU89306

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51793

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in image_copy_plane() function in libavutil/imgutils.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Buffer overflow

EUVDB-ID: #VU89307

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51795

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in showspectrumpic_request_frame() function in libavfilter/avf_showspectrum.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Buffer overflow

EUVDB-ID: #VU89308

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51796

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the areverse_request_frame() function in libavfilter/f_reverse.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Buffer overflow

EUVDB-ID: #VU89309

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51797

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the showwaves_filter_frame() function in libavfilter/avf_showwaves.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Buffer overflow

EUVDB-ID: #VU89310

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51798

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to a boundary error in libavfilter/vf_minterpolate.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Buffer overflow

EUVDB-ID: #VU89311

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-50007

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the heav_samples_set_silence() function in thelibavutil/samplefmt.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Buffer overflow

EUVDB-ID: #VU89312

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-50008

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in av_malloc() function in libavutil/mem.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Buffer overflow

EUVDB-ID: #VU89316

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-50009

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the ff_gaussian_blur_8() function in libavfilter/edge_template.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Buffer overflow

EUVDB-ID: #VU89317

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-50010

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the set_encoder_id() function in /fftools/ffmpeg_enc.c A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Out-of-bounds write

EUVDB-ID: #VU89420

Risk: Critical

CVSSv3.1: 8.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2024-4761

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in V8. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Install updates from vendor's repository.

Fedora: 8

chromium: before 125.0.6422.60-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:
• cpe:2.3:o:fedoraproject:chromium:*:*:*:*:*:fedora:*:

http://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1fb3cec2e0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.