CVE-2023-1529
Out of bounds memory access in WebHID in Google Chrome prior to 111.0. ...
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Ubuntu (medium).
Description
Out of bounds memory access in WebHID in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a malicious HID device. (Chromium security severity: High)
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.17 | qt5-qtwebengine | 5.15.12-r3 |
| alpine 3.18 | qt5-qtwebengine | 5.15.12-r9 |
| alpine 3.19 | qt5-qtwebengine | 5.15.12-r9 |
| alpine 3.20 | qt5-qtwebengine | 5.15.12-r9 |
| alpine 3.21 | qt5-qtwebengine | 5.15.12-r9 |
| alpine 3.22 | qt5-qtwebengine | 5.15.12-r9 |
| alpine 3.23 | qt5-qtwebengine | 5.15.12-r9 |
| debian 10 | chromium | no fix listed |
| debian 11 | chromium | 111.0.5563.110-1~deb11u1 |
| debian 12 | chromium | 111.0.5563.110-1 |
| debian 13 | chromium | 111.0.5563.110-1 |
| debian 14 | chromium | 111.0.5563.110-1 |
Show all 17 entries from 17 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.17 | qt5-qtwebengine | 5.15.12-r3 |
| alpine 3.18 | qt5-qtwebengine | 5.15.12-r9 |
| alpine 3.19 | qt5-qtwebengine | 5.15.12-r9 |
| alpine 3.20 | qt5-qtwebengine | 5.15.12-r9 |
| alpine 3.21 | qt5-qtwebengine | 5.15.12-r9 |
| alpine 3.22 | qt5-qtwebengine | 5.15.12-r9 |
| alpine 3.23 | qt5-qtwebengine | 5.15.12-r9 |
| debian 10 | chromium | no fix listed |
| debian 11 | chromium | 111.0.5563.110-1~deb11u1 |
| debian 12 | chromium | 111.0.5563.110-1 |
| debian 13 | chromium | 111.0.5563.110-1 |
| debian 14 | chromium | 111.0.5563.110-1 |
| echo | chromium | 111.0.5563.110-1 |
| rapidfort ubuntu 20.04 | chromium-browser | no fix listed |
| rapidfort ubuntu 22.04 | chromium-browser | no fix listed |
| rapidfort ubuntu 24.04 | chromium-browser | no fix listed |
| ubuntu 18.04 | chromium-browser | 112.0.5615.49-0ubuntu0.18.04.1 |
References
- https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html
- https://crbug.com/1419718
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3QZY4UQFP4XNF43ILMVVOABMB7KAQ5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NGWWGQULJ7QRNP4GY57HE7OO7VMRWMPN/
- https://security.gentoo.org/glsa/202309-17
- https://ubuntu.com/security/notices/USN-6021-1
- https://www.cve.org/CVERecord?id=CVE-2023-1529