CVE-2023-0941

Use after free in Prompts in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

Chromium updated Chromium to 110.0.5481.177 to fix vulnerabilities including [CVE-2023-0927] Use after free in Web Payments API. [CVE-2023-0928] Use after free in SwiftShader. [CVE-2023-0929] Use after free in Vulkan. [CVE-2023-0930] Heap buffer overflow in Video. [CVE-2023-0931] Use after free in Video. [CVE-2023-0932] Use after free in WebRTC. [CVE-2023-0933] Integer overflow in PDF. [CVE-2023-0941] Use after free in Prompts.

This update for chromium fixes the following issues:

Chromium 110.0.5481.177 (boo#1208589)

• CVE-2023-0927: Use after free in Web Payments API
• CVE-2023-0928: Use after free in SwiftShader
• CVE-2023-0929: Use after free in Vulkan
• CVE-2023-0930: Heap buffer overflow in Video
• CVE-2023-0931: Use after free in Video
• CVE-2023-0932: Use after free in WebRTC
• CVE-2023-0933: Integer overflow in PDF
• CVE-2023-0941: Use after free in Prompts
• Various fixes from internal audits, fuzzing and other initiatives

Chromium 110.0.5481.100

• fix regression on SAP Business Objects web UI
• fix date formatting behavior change from ICU 72

This update for opera fixes the following issues:

Update to 96.0.4693.31

• CHR-9206 Update Chromium on desktop-stable-110-4693 to 110.0.5481.178
• DNA-104492 [Stable A/B Test] React Start Page for Austria 50%
• DNA-104660 Browser crash when calling window.opr.authPrivate API in a private mode
• DNA-105000 Crash at non-virtual thunk to SadTabView::OnBoundsChanged(gfx::Rect const&)
• DNA-105138 Hang-up button is red in video popout
• DNA-105211 Johnny5 – Prepare extension to be usable in Desktop
• DNA-105377 Add API for extension to be able to open sidebar panel
• DNA-105378 Add 'AI Shorten' functionality to search/copy tooltip
• DNA-105410 Change Popup functionality depending on number of words selected
• DNA-105429 Fix privileges for Shodan api
• DNA-105434 Change popup depending on number of words
• DNA-105442 Fix Update & Recovery page styling
• DNA-105455 [Search box] Search box does not resize dynamically
• DNA-105606 Enabling news by default on SP test- 2

The update to chromium 110.0.5481.178 fixes following issues:
CVE-2023-0927, CVE-2023-0928, CVE-2023-0929, CVE-2023-0930, CVE-2023-0931, CVE-2023-0932, CVE-2023-0933, CVE-2023-0941

This update for opera fixes the following issues:

• Update to 99.0.4788.13

  • CHR-9290 Update Chromium on desktop-stable-113-4788 to 113.0.5672.127
  • DNA-107317 __delayLoadHelper2 crash in crashreporter

• The update to chromium 113.0.5672.127 fixes following issues: CVE-2023-2721, CVE-2023-2722, CVE-2023-2723, CVE-2023-2724, CVE-2023-2725, CVE-2023-2726

• Update to 99.0.4788.9

  • CHR-9283 Update Chromium on desktop-stable-113-4788 to 113.0.5672.93
  • DNA-107638 Translations for O99
  • DNA-107678 Crash Report [@ BrowserContextKeyedServiceFactory:: BrowserContextKeyedServiceFactory(char const*, BrowserContextDependencyManager*) ]
  • DNA-107795 Fix wrong german translation of 'Close All Duplicate Tabs'
  • DNA-107800 Fonts on section#folder and AddSitePanel not readable when animated wallpaper chosen
  • DNA-107840 Promote O99 to stable

• Update to 98.0.4759.39

  • DNA-102363 ChromeFileSystemAccessPermissionContextTest. ConfirmSensitiveEntryAccess_DangerousFile fails
  • DNA-105534 [Add to Opera] Incorrect scroll on modal when browser window size is too small
  • DNA-106649 Opening new tab when pinned tab is active gives 2 active tabs
  • DNA-107226 Speed Dial freezes and empty space remains after Continue booking tile dragging
  • DNA-107435 Building archive_source_release target fails
  • DNA-107441 [Start page] Right mouse click on tile in continue on section opens target site in current tab
  • DNA-107508 Crash at permissions::PermissionRecoverySuccessRate Tracker::TrackUsage(ContentSettingsType)
  • DNA-107528 Handle real-time SD impression reporting
  • DNA-107546 Context menus broken with one workspace
  • DNA-107548 Paste from Context Menu doesn’t work for Search on StartPage
  • DNA-107560 Optimize real-time SD impression reporting

These are all security issues fixed in the chromedriver-110.0.5481.177-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that Chromium could be made to write out of bounds in several components. A remote attacker could possibly use this issue to corrupt memory via a crafted HTML page, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-0930, CVE-2023-1219, CVE-2023-1220, CVE-2023-1222)

It was discovered that Chromium contained an integer overflow in the PDF component. A remote attacker could possibly use this issue to corrupt memory via a crafted PDF file, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-0933)

It was discovered that Chromium did not properly manage memory in several components. A remote attacker could possibly use this issue to corrupt memory via a crafted HTML page, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-0941, CVE-2023-0928, CVE-2023-0929, CVE-2023-0931, CVE-2023-1213, CVE-2023-1216, CVE-2023-1218)

It was discovered that Chromium did not correctly distinguish data types in several components. A remote attacker could possibly use this issue to corrupt memory via a crafted HTML page, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-1214, CVE-2023-1215, CVE-2023-1235)

It was discovered that Chromium insufficiently enforced policies. An attacker could possibly use this issue to bypass navigation restrictions. (CVE-2023-1221, CVE-2023-1224)

It was discovered that Chromium insufficiently enforced policies in Web Payments API. A remote attacker could possibly use this issue to bypass content security policy via a crafted HTML page. (CVE-2023-1226)

It was discovered that Chromium contained an inappropriate implementation in the Permission prompts component. A remote attacker could possibly use this issue to bypass navigation restrictions via a crafted HTML page. (CVE-2023-1229)

It was discovered that Chromium insufficiently enforced policies in Resource Timing component. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2023-1232, CVE-2023-1233)

It was discovered that Chromium contained an inappropriate implementation in the Internals component. A remote attacker could possibly use this issue to spoof the origin of an iframe via a crafted HTML page. (CVE-2023-1236)