SB2024041862 - Multiple vulnerabilities in Microsoft Edge
Published: April 18, 2024 Updated: April 26, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 17 secuirty vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2024-3834)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the Downloads component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
2) Buffer overflow (CVE-ID: CVE-2024-3832)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to a boundary error in V8 in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger memory corruption and execute arbitrary code on the system.
3) Information disclosure (CVE-ID: CVE-2024-29987)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote attacker can trick the victim to visit a specially crafted website and gain access to user's personal information.4) Improperly implemented security check for standard (CVE-ID: CVE-2024-3846)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to incorrect implementation in Prompts in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.
5) Improperly implemented security check for standard (CVE-ID: CVE-2024-3845)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to incorrect implementation in Network in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.
6) Input validation error (CVE-ID: CVE-2024-3843)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied input in Downloads in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.
7) Use-after-free (CVE-ID: CVE-2024-3837)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within QUIC in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.
8) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2024-3840)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient policy enforcement in Site Isolation in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.
9) Improperly implemented security check for standard (CVE-ID: CVE-2024-3844)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to incorrect implementation in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.
10) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2024-3847)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient policy enforcement in WebUI in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.
11) Out-of-bounds read (CVE-ID: CVE-2024-3839)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the Fonts component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.
12) Use-after-free (CVE-ID: CVE-2024-3914)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the V8 in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
13) Buffer overflow (CVE-ID: CVE-2024-3833)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to a boundary error in WebAssembly in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger memory corruption and execute arbitrary code on the system.
14) Information disclosure (CVE-ID: CVE-2024-29986)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote attacker can trick the victim to visit a specially crafted website and gain access to user's personal information.
15) Improperly implemented security check for standard (CVE-ID: CVE-2024-3838)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to incorrect implementation in Autofill in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.
16) Input validation error (CVE-ID: CVE-2024-3841)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied input in Browser Switcher in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.
17) Code Injection (CVE-ID: CVE-2024-29991)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to improper input validation. A remote attacker can trick the victim to visit a specially crafted website and bypass implemented security restrictions.
Remediation
Install update from vendor's website.
References
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-3834
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-3832
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-29987
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-3846
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-3845
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-3843
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-3837
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-3840
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-3844
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-3847
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-3839
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-3914
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-3833
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-29986
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-3838
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-3841
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29991
- https://www.zerodayinitiative.com/advisories/ZDI-24-399/