CVE-2023-7024
Description
Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome.
CISA KEV
- Vendor
- Product
- Chromium WebRTC
- Due date
- 2024-01-23
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cisa-kev — This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html; https://nvd.nist.gov/vuln/detail/CVE-2023-7024
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2023-7024
Exploits
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 120.0.6099.129-1~deb12u1 |
| debian | bullseye | fixed | 120.0.6099.129-1~deb11u1 |
| debian | forky | fixed | 120.0.6099.129-1 |
| debian | sid | fixed | 120.0.6099.129-1 |
| debian | trixie | fixed | 120.0.6099.129-1 |
References
- https://security-tracker.debian.org/tracker/CVE-2023-7024
- This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html; https://nvd.nist.gov/vuln/detail/CVE-2023-7024
Verify integrity in audit chain (admin only). AS-IS.