8.8

CVE-2022-2294

Warnung
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Google ≫ Chrome Version < 103.0.5060.114
Fedoraproject ≫ Fedora Version 35
Fedoraproject ≫ Fedora Version 36
Webkitgtk ≫ Webkitgtk Version < 2.36.5
Wpewebkit ≫ Wpe Webkit Version < 2.36.5
Apple ≫ iPadOS Version < 15.6
Apple ≫ iPhone OS Version < 15.6
Apple ≫ macOS X Version < 10.15.7
Apple ≫ macOS X Version 10.15.7 Update -
Apple ≫ macOS X Version 10.15.7 Update security_update_2020
Apple ≫ macOS X Version 10.15.7 Update security_update_2020-001
Apple ≫ macOS X Version 10.15.7 Update security_update_2020-005
Apple ≫ macOS X Version 10.15.7 Update security_update_2020-007
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-001
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-002
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-003
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-004
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-005
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-006
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-007
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-008
Apple ≫ macOS X Version 10.15.7 Update security_update_2022-001
Apple ≫ macOS X Version 10.15.7 Update security_update_2022-002
Apple ≫ macOS X Version 10.15.7 Update security_update_2022-003
Apple ≫ macOS X Version 10.15.7 Update security_update_2022-004
Apple ≫ macOS Version < 11.6.8
Apple ≫ macOS Version >= 12.0 < 12.5
Apple ≫ tvOS Version < 15.6
Apple ≫ watchOS Version < 8.7
Webrtc Project ≫ Webrtc Version -

25.08.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

WebRTC Heap Buffer Overflow Vulnerability

Schwachstelle

WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 70.46% 0.993
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA-ADP 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://security.gentoo.org/glsa/202208-39
Third Party Advisory
https://security.gentoo.org/glsa/202208-35
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/28/2
Third Party Advisory
Mailing List
https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.html
Vendor Advisory
Release Notes
https://crbug.com/1341043
Permissions Required
https://security.gentoo.org/glsa/202311-11
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/
Broken Link
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/
Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2294
US Government Resource