Google Chrome <103.0.5060.114 WebRTC堆缓冲区溢出漏洞

详细信息

漏洞类型

缓冲区错误

漏洞描述

Google Chrome是美国谷歌（Google）公司的一款Web浏览器。V8是其中的一套开源JavaScript引擎。Google Chrome 103.0.5060.114之前版本的WebRTC中存在堆缓冲区溢出，这是由WebRTC不正确的边界检查造成的。通过说服受害者访问精心编制的网站，远程攻击者可以溢出缓冲区并在系统上执行任意代码，或导致应用程序崩溃。

修复建议

升级至最新版本的Chrome（103.0.5060.114或更高版本），可从Google Chrome发布网站获得： https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.html

参考链接

• https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.html

  NVD · Release Notes · Vendor Advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/

  NVD

• http://www.openwall.com/lists/oss-security/2022/07/28/2

  NVD · mailing-list

• https://crbug.com/1341043

  NVD · Permissions Required · Vendor Advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/

  NVD

• https://www.cybersecurity-help.cz/vdb/SB2022070442
• https://www.cybersecurity-help.cz/vdb/SB2022072104
• https://vigilance.fr/vulnerability/Chrome-multiple-vulnerabilities-38727
• https://support.apple.com/en-us/HT213346
• https://vigilance.fr/vulnerability/WebKit-buffer-overflow-via-WebRTC-38874
• https://packetstormsecurity.com/files/167792/Apple-Security-Advisory-2022-07-20-7.html
• https://www.cybersecurity-help.cz/vdb/SB2022070614
• https://www.cybersecurity-help.cz/vdb/SB2022071824
• https://chromereleases.googleblog.com/2022/07/chrome-for-android-update.html
• https://www.auscert.org.au/bulletins/ESB-2022.3254
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-2294
• https://www.auscert.org.au/bulletins/ESB-2022.3553
• https://cxsecurity.com/cveshow/CVE-2022-2294/
• https://www.auscert.org.au/bulletins/ESB-2022.3389
• https://www.cybersecurity-help.cz/vdb/SB2022071215
• https://security.gentoo.org/glsa/202208-39

  NVD · vendor-advisory

• https://security.gentoo.org/glsa/202208-35

  NVD · vendor-advisory

• https://security.gentoo.org/glsa/202311-11

  NVD · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/

  NVD · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/

  NVD · vendor-advisory

• https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2022/2022-11.md
• https://osv.dev/vulnerability/DSA-5180-1

  OSV

• https://ubuntu.com/security/CVE-2022-2294

  OSV

• https://ubuntu.com/security/notices/USN-5568-1

  OSV

• https://www.cve.org/CVERecord?id=CVE-2022-2294

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  OSV

• https://osv.dev/vulnerability/UBUNTU-CVE-2022-2294

  OSV

• https://security-tracker.debian.org/tracker/CVE-2022-2294

  OSV

• https://osv.dev/vulnerability/CVE-2022-2294

  OSV

• https://osv.dev/vulnerability/DEBIAN-CVE-2022-2294

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2294

  NVD · US Government Resource