Asnine

اسم البرنامج المعرض للخطر والإصدارات المتأثرة إصدارات متصفح Google Chrome الأقدم من 147.0.7727.55 الوصف كانت هناك مشكلة تتعلق بتجاوز السياسات في مكون LocalNetworkAccess داخل متصفح Google Chrome. فقد تسمح صفحة HTML مُصممة خصيصًا لمهاجم عن بُعد بتجاوز قيود التنقل. التوصيات قم بتحديث متصفح Google Chrome إلى الإصدار 147.0.7727.55 أو أحدث.

تسمح هذه الثغرة الأمنية لمهاجم عن بُعد بالوصول إلى الذاكرة خارج الحدود المسموح بها من خلال ملف PDF تم التلاعب به. ويرجع ذلك إلى قراءة خارج الحدود المسموح بها في مكتبة PDFium في Google Chrome. وقد صنفت Chromium خطورة هذه الثغرة الأمنية على أنها متوسطة.

تتعلق المشكلة بثغرة أمنية من نوع «استغلال بعد الإفراج» (use-after-free) في وظيفة التصفح في متصفحي Google Chrome وMicrosoft Edge. تسمح هذه الثغرة لمهاجم عن بُعد باستغلال تلف الـ«هيوب» (heap) عبر ملحق Chrome تم التلاعب به، مما قد يؤدي إلى تنفيذ التعليمات البرمجية عن بُعد أو رفض الخدمة. تُعتبر خطورة هذه المشكلة عالية.

كانت هناك مشكلة «الاستخدام بعد التحرير» (use-after-free) في مكون الإضافات في Google Chrome. وكان ذلك يسمح لمهاجم عن بُعد باستغلال تلف الـ«هيوب» (heap) من خلال ملحق Chrome مصمم خصيصًا لهذا الغرض. تم تصنيف خطورة هذه الثغرة الأمنية على أنها «متوسطة».

The issue is related to an elevation of privilege vulnerability in Microsoft Edge, which is based on Chromium. This vulnerability can be exploited by a remote attacker to elevate their privileges. The vulnerability is associated with access control errors.

The issue is related to a use after free in the Extensions component of Google Chrome, which could allow an attacker to exploit heap corruption via a crafted HTML page if a user is convinced to install a malicious extension. The severity of this issue is classified as Medium by Chromium security.

The issue is related to a use after free in WebRTC, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code execution.

The issue is related to a use after free in DevTools, allowing a remote attacker who has compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. This could lead to unauthorized access to confidential data, disruption of data integrity, and denial of service. The attacker can use a specially crafted HTML page to exploit this issue.

The issue is related to a use after free in the Extensions component of Google Chrome, which could allow an attacker to exploit heap corruption via a crafted HTML page if a user is convinced to install a malicious extension. This could potentially lead to access to confidential data, disruption of data integrity, and denial of service.

The issue is related to the use of memory after it has been freed in the Guest View mode of Google Chrome and Microsoft Edge browsers. This could allow a remote attacker to impact the confidentiality, integrity, and availability of protected information by using a specially crafted HTML page. An attacker who convinces a user to install a malicious extension could potentially exploit heap corruption.

The issue is related to a heap buffer overflow in the Network Service of Google Chrome, which could be exploited by an attacker who convinces a user to install a malicious extension. This exploitation could potentially lead to heap corruption via a crafted HTML page and specific interactions. The severity of this issue is considered high.

The issue is related to insufficient validation of untrusted input, which can be exploited by a remote attacker to bypass download restrictions via a malicious file. This could potentially allow the attacker to disclose protected information.

The issue is related to a use after free in Blink, which can lead to heap corruption. A remote attacker can potentially exploit this via a crafted HTML page. This may impact the confidentiality, integrity, and availability of protected information.

A remote code execution issue exists due to the way Microsoft scripting engines handle objects in memory, potentially allowing an attacker to execute arbitrary code in the context of the current user. This could be achieved by corrupting memory, and if the current user has administrative rights, an attacker could take control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.