This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Google Chrome fixes 37 vulnerabilities
Google fixes 37 vulnerabilities (19 of them publicly disclosed) in Google Chrome and also in web browsers based on Chromium. Google fixed the vulnerabilities for Chrome on Linux in version 128.0.6613.84 and for Chrome on Windows/Mac in version 128.0.6613.84/.85 [1]. The vulnerability CVE-2024-7971 was fixed by Microsoft for Edge in version 128.0.2739.42 [2]. The most severe vulnerabilities are listed below.
An unauthenticated remote attacker can gain unauthorized access to memory on a victim viewing specially crafted web pages, which may lead to data corruption, unauthorized reading of information and potentially code execution [3][4]. Google states that a publicly available script exists that allows exploitation of the vulnerability CVE-2024-7971 [1].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-7971 at cve.org, NVD
- CVE-2024-7969 at cve.org, NVD
- CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') at cwe.mitre.org
The vulnerability was publicly disclosed 21. 9. 2024.
An unauthenticated remote attacker can, on a victim viewing specially crafted web pages, carry out a DoS attack, corrupt data in memory or potentially execute code [5][6].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-7964 at cve.org, NVD
- CVE-2024-7968 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 21. 8. 2024.
An unauthenticated remote attacker can write to memory without authorization on a victim viewing specially crafted web pages, which may lead to a DoS attack or memory data corruption [7]. Google states that a publicly available script exists that allows exploitation of this vulnerability [1].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-7965 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 21. 9. 2024.
An unauthenticated remote attacker can write to memory without authorization on a victim viewing specially crafted PDF files, which may lead to a DoS attack or memory data corruption [8].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-7973 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 21. 8. 2024.
An authenticated remote attacker can escalate their privileges in the Google Chrome installer on Windows by using a specially crafted file or symbolic link [9][10][11].
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-7977 at cve.org, NVD
- CVE-2024-7979 at cve.org, NVD
- CVE-2024-7980 at cve.org, NVD
- CWE-345: Insufficient Verification of Data Authenticity at cwe.mitre.org
The vulnerability was publicly disclosed 21. 8. 2024.
Links
- [1] https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html
- [2] https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security#august-22-2024
- [3] https://nvd.nist.gov/vuln/detail/CVE-2024-7971
- [4] https://nvd.nist.gov/vuln/detail/CVE-2024-7969
- [5] https://nvd.nist.gov/vuln/detail/CVE-2024-7964
- [6] https://nvd.nist.gov/vuln/detail/CVE-2024-7968
- [7] https://nvd.nist.gov/vuln/detail/CVE-2024-7965
- [8] https://nvd.nist.gov/vuln/detail/CVE-2024-7973
- [9] https://nvd.nist.gov/vuln/detail/CVE-2024-7977
- [10] https://nvd.nist.gov/vuln/detail/CVE-2024-7979
- [11] https://nvd.nist.gov/vuln/detail/CVE-2024-7980
By CESNET, z.s.p.o. Martin Krajči on 3. 9. 2024.