CVE-2023-4354 - Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page

Back Back to CVE browser

HIGH

Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page

Published Aug 15, 2023

8.8

HIGH

CVSS 3.1

EPSS 1.65%

Description

Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Affected products

Vendor Google Product Chrome Default
n/a
- Version
  116.0.5845.96
  Status
  affected
  Constraints
  <116.0.5845.96

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Google

Chrome

n/a

Version	Status	Constraints
116.0.5845.96	affected	<116.0.5845.96

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (8)

http://packetstormsecurity.com/files/174949/Chrome-SKIA-Integer-Overflow.html
Third Party AdvisoryVDB Entry
https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
Release NotesVendor Advisory
https://crbug.com/1464215
Permissions Required
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54218
Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
Mailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
Mailing ListThird Party Advisory
https://security.gentoo.org/glsa/202401-34
https://www.debian.org/security/2023/dsa-5479
Third Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/174949/Chrome-SKIA-Integer-Overflow.html		Third Party AdvisoryVDB Entry
https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html		Release NotesVendor Advisory
https://crbug.com/1464215		Permissions Required
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54218		Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/		Mailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/		Mailing ListThird Party Advisory
https://security.gentoo.org/glsa/202401-34
https://www.debian.org/security/2023/dsa-5479		Third Party Advisory