Google Chrome <107.0.5304.121 GPU堆缓冲区溢出漏洞

详细信息

漏洞类型

其他

漏洞描述

107.0.5304.121之前版本的Google Chrome中GPU中的堆缓冲区溢出允许破坏渲染器进程的远程攻击者通过特制的HTML页面执行沙盒逃脱。

修复建议

升级至Google Chrome的最新版本（107.0.5304.121或更高版本），可从Google Chrome发布网站获得： https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html

参考链接

• https://crbug.com/1392715

  OSV · Permissions Required

• https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html

  OSV

• https://vigilance.fr/vulnerability/Chrome-buffer-overflow-via-GPU-39958
• https://www.auscert.org.au/bulletins/ESB-2022.6153
• https://cxsecurity.com/cveshow/CVE-2022-4135/
• https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html

  NVD · Release Notes · Vendor Advisory

• https://security.gentoo.org/glsa/202305-10

  OSV · vendor-advisory

• https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-02.md
• https://nvd.nist.gov/vuln/detail/CVE-2022-4135

  OSV

• https://github.com/electron/electron/pull/36444

  OSV

• https://github.com/electron/electron/pull/36447

  OSV

• https://github.com/advisories/GHSA-995f-9x5r-2rcj
• https://osv.dev/vulnerability/DSA-5289-1

  OSV

• https://osv.dev/vulnerability/GHSA-995f-9x5r-2rcj

  OSV

• https://osv.dev/vulnerability/CVE-2022-4135

  OSV

• https://security-tracker.debian.org/tracker/CVE-2022-4135

  OSV

• https://ubuntu.com/security/CVE-2022-4135

  OSV

• https://www.cve.org/CVERecord?id=CVE-2022-4135

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  OSV

• https://osv.dev/vulnerability/UBUNTU-CVE-2022-4135

  OSV

• https://osv.dev/vulnerability/DEBIAN-CVE-2022-4135

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-4135

  NVD