高危
Google Chrome安全漏洞(CVE-2023-7024)
2023-12-21 00:00:00 公开 ，2026-02-27 05:58:21 更新
- CISA KEV
- 关键漏洞
- 远程
- 无需认证
- CWE Top 25 (2023)
- 开源组件漏洞
- CWE Top 25 (2024)
- 公开PoC
- SSVC：
- 可利用状态：已被积极利用攻击自动化：否技术影响评估：全部 2023-12-23 13:01:04
风险信息
- CVSS v3.1 向量
- AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v3.1 风险值
- 8.8
详细信息
- 漏洞类型
- 其他
- 漏洞描述
- Google Chromium WebRTC是一个为web浏览器提供实时通信的开源项目，Google Chrome 120.0.6099.129之前版本的WebRTC中存在堆缓冲区溢出，远程攻击者可以通过特制的HTML页面利用堆损坏进行潜在攻击，能够导致崩溃或代码执行。此漏洞可能会影响使用WebRTC的web浏览器，包括但不限于Google Chrome。
- 修复建议
- 从Google Chrome Releases网站升级至Google Chrome的最新版本（120.0.6099.129或120.0.6099.130或更高版本）。参考链接： https://chromereleases.googleblog.com/
参考链接
- https://www.auscert.org.au/bulletins/ESB-2023.7619
- https://crbug.com/1513170
NVD · Permissions Required
- https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html
NVD · Release Notes · Vendor Advisory
- https://www.debian.org/security/2023/dsa-5585
NVD · Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6JL4VHZMHFGEGQYTF74533ZNRWMCMMR/
NVD · Mailing List · Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6M6AJDHUL6EDPURWQXGLUFJNDE7SOJT3/
NVD · Third Party Advisory · Mailing List
- https://security.gentoo.org/glsa/202401-34
NVD · Third Party Advisory
- https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-03.md
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Snyk
- https://security.snyk.io/vuln/SNYK-JS-ELECTRON-6137744
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6137902
- https://security.snyk.io/vuln/SNYK-UNMANAGED-CHROMIUM-6134593
- https://osv.dev/vulnerability/DSA-5585-1
OSV
- https://osv.dev/vulnerability/CVE-2023-7024
OSV
- https://security-tracker.debian.org/tracker/CVE-2023-7024
OSV
- https://osv.dev/vulnerability/DEBIAN-CVE-2023-7024
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7024
NVD