Google Chrome <105.0.5195.52 Network Service代码执行漏洞

详细信息

漏洞类型

授权问题

漏洞描述

Google Chrome是美国谷歌（Google）公司的一款Web浏览器。Google Chrome 105.0.5195.52以前版本可能允许远程攻击者在系统上执行任意代码，这是由于在Network Service中use-after-free造成的，远程攻击者可以通过特制的HTML页面利用堆损坏进行潜在的攻击。

修复建议

升级至Chrome的最新版本（105.0.5195.54或更高版本），可从Google Chrome发布网站获得： https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html

参考链接

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-3038
• https://vigilance.fr/vulnerability/Chrome-multiple-vulnerabilities-39152
• https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html

  CVE · x_refsource_MISC

• https://crbug.com/1340253

  CVE · x_refsource_MISC

• http://packetstormsecurity.com/files/168596/Google-Chrome-103.0.5060.53-network-URLLoader-NotifyCompleted-Heap-Use-After-Free.html

  CVE · x_refsource_MISC

• https://security.gentoo.org/glsa/202209-23

  CVE · vendor-advisory · x_refsource_GENTOO

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/

  CVE · vendor-advisory · x_refsource_FEDORA

• https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-01.md
• https://osv.dev/vulnerability/DSA-5223-1

  OSV

• https://osv.dev/vulnerability/CVE-2022-3038

  OSV

• https://security-tracker.debian.org/tracker/CVE-2022-3038

  OSV

• https://ubuntu.com/security/CVE-2022-3038

  OSV

• https://www.cve.org/CVERecord?id=CVE-2022-3038

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  OSV

• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3038

  OSV

• https://osv.dev/vulnerability/DEBIAN-CVE-2022-3038

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-3038

  NVD