Type confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-0b39dc9302 advisory.

  - Type confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-5346)

  - Use after free in Profiles in Google Chrome prior to 118.0.5993.117 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-5472)

  - Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)     (CVE-2023-5218)

  - Use after free in Cast in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium     security severity: Low) (CVE-2023-5473)

  - Heap buffer overflow in PDF in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who     convinced a user to engage in specific user interactions to potentially exploit heap corruption via a     crafted PDF file. (Chromium security severity: Medium) (CVE-2023-5474)

  - Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who     convinced a user to install a malicious extension to bypass discretionary access control via a crafted     Chrome Extension. (Chromium security severity: Medium) (CVE-2023-5475)

  - Use after free in Blink History in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)     (CVE-2023-5476)

  - Inappropriate implementation in Installer in Google Chrome prior to 118.0.5993.70 allowed a local attacker     to bypass discretionary access control via a crafted command. (Chromium security severity: Low)     (CVE-2023-5477)

  - Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker     to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) (CVE-2023-5478)

  - Inappropriate implementation in Extensions API in Google Chrome prior to 118.0.5993.70 allowed an attacker     who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML     page. (Chromium security severity: Medium) (CVE-2023-5479)

  - Inappropriate implementation in Downloads in Google Chrome prior to 118.0.5993.70 allowed a remote     attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)     (CVE-2023-5481)

  - Inappropriate implementation in Intents in Google Chrome prior to 118.0.5993.70 allowed a remote attacker     to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)     (CVE-2023-5483)

  - Inappropriate implementation in Navigation in Google Chrome prior to 118.0.5993.70 allowed a remote     attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)     (CVE-2023-5484)

  - Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker     to bypass autofill restrictions via a crafted HTML page. (Chromium security severity: Low) (CVE-2023-5485)

  - Inappropriate implementation in Input in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to     spoof security UI via a crafted HTML page. (Chromium security severity: Low) (CVE-2023-5486)

  - Inappropriate implementation in Fullscreen in Google Chrome prior to 118.0.5993.70 allowed an attacker who     convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome     Extension. (Chromium security severity: Medium) (CVE-2023-5487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-8c9fd2a001 advisory.

  - Type confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-5346)

  - Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)     (CVE-2023-5218)

  - Use after free in Cast in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium     security severity: Low) (CVE-2023-5473)

  - Heap buffer overflow in PDF in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who     convinced a user to engage in specific user interactions to potentially exploit heap corruption via a     crafted PDF file. (Chromium security severity: Medium) (CVE-2023-5474)

  - Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who     convinced a user to install a malicious extension to bypass discretionary access control via a crafted     Chrome Extension. (Chromium security severity: Medium) (CVE-2023-5475)

  - Use after free in Blink History in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)     (CVE-2023-5476)

  - Inappropriate implementation in Installer in Google Chrome prior to 118.0.5993.70 allowed a local attacker     to bypass discretionary access control via a crafted command. (Chromium security severity: Low)     (CVE-2023-5477)

  - Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker     to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) (CVE-2023-5478)

  - Inappropriate implementation in Extensions API in Google Chrome prior to 118.0.5993.70 allowed an attacker     who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML     page. (Chromium security severity: Medium) (CVE-2023-5479)

  - Inappropriate implementation in Downloads in Google Chrome prior to 118.0.5993.70 allowed a remote     attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)     (CVE-2023-5481)

  - Inappropriate implementation in Intents in Google Chrome prior to 118.0.5993.70 allowed a remote attacker     to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)     (CVE-2023-5483)

  - Inappropriate implementation in Navigation in Google Chrome prior to 118.0.5993.70 allowed a remote     attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)     (CVE-2023-5484)

  - Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker     to bypass autofill restrictions via a crafted HTML page. (Chromium security severity: Low) (CVE-2023-5485)

  - Inappropriate implementation in Input in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to     spoof security UI via a crafted HTML page. (Chromium security severity: Low) (CVE-2023-5486)

  - Inappropriate implementation in Fullscreen in Google Chrome prior to 118.0.5993.70 allowed an attacker who     convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome     Extension. (Chromium security severity: Medium) (CVE-2023-5487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-274239e279 advisory.

  - Type confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-5346)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2023:0292-1 advisory.

  - Type confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-5346)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5515 advisory.

  - Type Confusion in V8. (CVE-2023-5346)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Microsoft Edge installed on the remote Windows host is prior to 117.0.2045.55. It is, therefore, affected by a vulnerability as referenced in the October 4, 2023 advisory.

  - Type Confusion in V8. (CVE-2023-5346)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4e45c45b-629e-11ee-8290-a8a1599412c6 advisory.

  - Type Confusion in V8. (CVE-2023-5346)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 117.0.5938.149. It is, therefore, affected by a vulnerability as referenced in the 2023_10_stable-channel-update-for-desktop advisory.

  - Type Confusion in V8. (CVE-2023-5346)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 117.0.5938.149. It is, therefore, affected by a vulnerability as referenced in the 2023_10_stable-channel-update-for-desktop advisory.

  - Type Confusion in V8. (CVE-2023-5346)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
189844	GLSA-202401-34 : Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
185166	Fedora 39 : chromium (2023-0b39dc9302)	Nessus	Fedora Local Security Checks	high
183652	Fedora 38 : chromium (2023-8c9fd2a001)	Nessus	Fedora Local Security Checks	high
182803	Fedora 37 : chromium (2023-274239e279)	Nessus	Fedora Local Security Checks	high
182676	openSUSE 15 Security Update : chromium (openSUSE-SU-2023:0292-1)	Nessus	SuSE Local Security Checks	high
182559	Debian DSA-5515-1 : chromium - security update	Nessus	Debian Local Security Checks	high
182556	Microsoft Edge (Chromium) < 117.0.2045.55 (CVE-2023-5346)	Nessus	Windows	high
182515	FreeBSD : chromium -- type confusion in v8 (4e45c45b-629e-11ee-8290-a8a1599412c6)	Nessus	FreeBSD Local Security Checks	high
182442	Google Chrome < 117.0.5938.149 Vulnerability	Nessus	Windows	high
182441	Google Chrome < 117.0.5938.149 Vulnerability	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2023-5346

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high