This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Google Chrome fixes 4 vulnerabilities
Google is fixing 4 vulnerabilities in Google Chrome (originally in the V8 and Dawn components) [1], which also affect Chromium-based web browsers such as Opera or Microsoft Edge, of which only Microsoft has fixed the vulnerabilities so far [2][3][4][5]. Chrome fixed the vulnerabilities in versions 126.0.6478.114/115 for Windows and Mac and in version 126.0.6478.114 for Linux [1].
An unauthenticated remote attacker can execute arbitrary code by tricking the victim into visiting a specially crafted page [6].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-6100 at cve.org, NVD
- CWE-843 at cwe.mitre.org
The vulnerability was publicly disclosed 19. 6. 2024.
An unauthenticated remote attacker can access memory out of bounds by tricking the victim into visiting a specially crafted page, which may lead to unauthorized access to information, a DoS attack or remote code execution [7].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-6101 at cve.org, NVD
- CWE-788 at cwe.mitre.org
The vulnerability was publicly disclosed 19. 6. 2024.
An unauthenticated remote attacker can make unauthorized modifications to data in the heap by tricking the victim into visiting a specially crafted page, which may lead to unauthorized deletion of data, a DoS attack or remote code execution [8].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-6102 at cve.org, NVD
- CWE-787 at cwe.mitre.org
The vulnerability was publicly disclosed 19. 6. 2024.
An unauthenticated remote attacker can access memory after it has been freed by tricking the victim into visiting a specially crafted page, which may lead to unauthorized data access, a DoS attack or remote code execution [9].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-6103 at cve.org, NVD
- CWE-416 at cwe.mitre.org
The vulnerability was publicly disclosed 19. 6. 2024.
Links
- [1] https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html
- [2] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-6100
- [3] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-6101
- [4] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-6102
- [5] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-6103
- [6] https://nvd.nist.gov/vuln/detail/CVE-2024-6100
- [7] https://nvd.nist.gov/vuln/detail/CVE-2024-6101
- [8] https://nvd.nist.gov/vuln/detail/CVE-2024-6102
- [9] https://nvd.nist.gov/vuln/detail/CVE-2024-6103
By CESNET, z.s.p.o. Martin Krajči on 26. 6. 2024.