SB2023112020 - Multiple vulnerabilities in Google ChromeOS
Published: November 20, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 secuirty vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2023-21216)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in PowerVR GPU driver. A local user can trigger a use-after-free error and perform a denial of service (DoS) attack.
2) Use-after-free (CVE-ID: CVE-2023-5996)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the WebAudio component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
3) Input validation error (CVE-ID: CVE-2023-35685)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to an unspecified error. A local user can execute arbitrary code with elevated privileges.
4) Use-after-free (CVE-ID: CVE-2023-4244)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the Linux kernel netfilter: nf_tables component. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.
5) Use-after-free (CVE-ID: CVE-2023-5197)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within Linux kernel netfilter: nf_tables component. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.
6) Information exposure (CVE-ID: CVE-2023-40113)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper input validation within the System component. A local application can gain access to sensitive information.
7) Improper input validation (CVE-ID: CVE-2023-40109)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation within the Framework component. A local application can execute arbitrary code.
8) Improper input validation (CVE-ID: CVE-2023-40114)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation within the Framework component. A local application can execute arbitrary code.
9) Improper input validation (CVE-ID: CVE-2023-40110)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation within the Framework component. A local application can execute arbitrary code.
10) Information exposure (CVE-ID: CVE-2023-40112)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper input validation within the System component. A local application can gain access to sensitive information.
11) Input validation error (CVE-ID: CVE-2023-40118)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to an unspecified error. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.