Urgent: New Chrome Zero-Day Vulnerability Exploited in the Wild - Update ASAP - GoFuckYourself.com

TheLegacy · 12-22-2023, 07:07 AM

Google has rolled out security updates for the Chrome web browser to address a high-severity zero-day flaw that it said has been exploited in the wild.

The vulnerability, assigned the CVE identifier CVE-2023-7024, has been described as a heap-based buffer overflow bug in the WebRTC framework that could be exploited to result in program crashes or arbitrary code execution.

Clément Lecigne and Vlad Stolyarov of Google's Threat Analysis Group (TAG) have been credited with discovering and reporting the flaw on December 19, 2023.

No other details about the security defect have been released to prevent further abuse, with Google acknowledging that "an exploit for CVE-2023-7024 exists in the wild."

Given that WebRTC is an open-source project and that it's also supported by Mozilla Firefox and Apple Safari, it's currently not clear if the flaw has any impact beyond Chrome and Chromium-based browsers.

The development marks the resolution of the eighth actively exploited zero-day in Chrome since the start of the year -

CVE-2023-2033 (CVSS score: 8.8) - Type confusion in V8
CVE-2023-2136 (CVSS score: 9.6) - Integer overflow in Skia
CVE-2023-3079 (CVSS score: 8.8) - Type confusion in V8
CVE-2023-4762 (CVSS score: 8.8) - Type confusion in V8
CVE-2023-4863 (CVSS score: 8.8) - Heap buffer overflow in WebP
CVE-2023-5217 (CVSS score: 8.8) - Heap buffer overflow in vp8 encoding in libvpx
CVE-2023-6345 (CVSS score: 9.6) - Integer overflow in Skia

A total of 26,447 vulnerabilities have been disclosed so far in 2023, surpassing the previous year by over 1,500 CVEs, according to data compiled by Qualys, with 115 flaws exploited by threat actors and ransomware groups.

Remote code execution, security feature bypass, buffer manipulation, privilege escalation, and input validation and parsing flaws emerged as the top vulnerability types.

Users are recommended to upgrade to Chrome version 120.0.6099.129/130 for Windows and 120.0.6099.129 for macOS and Linux to mitigate potential threats.

Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi are also advised to apply the fixes as and when they become available.

https://thehackernews.com/2023/12/ur...8KBKb0yp0RoDtE

CurrentlySober · 12-22-2023, 07:42 AM

Updated both Windows & Mac OS - Cheers!

I'd hate anyone to try and steal my poo!

Klen · 12-22-2023, 08:41 AM

Update done

Focus · 12-22-2023, 10:58 AM

Done, and thanks for the heads up!

Axeman · 12-22-2023, 12:15 PM

Thx for the heads up. Forced the update.

lezinterracial · 12-22-2023, 01:04 PM

crazy.

I figured their magic pointer would fix dangling pointers, would fix almost everything. I figured overflows wouldn't be a problem anymore either.

12-22-2023, 07:07 AM	#1
TheLegacy SEO Connoisseur Industry Role: Join Date: Apr 2003 Location: Brantford, Ontario Posts: 16,369	Urgent: New Chrome Zero-Day Vulnerability Exploited in the Wild - Update ASAP Google has rolled out security updates for the Chrome web browser to address a high-severity zero-day flaw that it said has been exploited in the wild. The vulnerability, assigned the CVE identifier CVE-2023-7024, has been described as a heap-based buffer overflow bug in the WebRTC framework that could be exploited to result in program crashes or arbitrary code execution. Clément Lecigne and Vlad Stolyarov of Google's Threat Analysis Group (TAG) have been credited with discovering and reporting the flaw on December 19, 2023. No other details about the security defect have been released to prevent further abuse, with Google acknowledging that "an exploit for CVE-2023-7024 exists in the wild." Given that WebRTC is an open-source project and that it's also supported by Mozilla Firefox and Apple Safari, it's currently not clear if the flaw has any impact beyond Chrome and Chromium-based browsers. The development marks the resolution of the eighth actively exploited zero-day in Chrome since the start of the year - CVE-2023-2033 (CVSS score: 8.8) - Type confusion in V8 CVE-2023-2136 (CVSS score: 9.6) - Integer overflow in Skia CVE-2023-3079 (CVSS score: 8.8) - Type confusion in V8 CVE-2023-4762 (CVSS score: 8.8) - Type confusion in V8 CVE-2023-4863 (CVSS score: 8.8) - Heap buffer overflow in WebP CVE-2023-5217 (CVSS score: 8.8) - Heap buffer overflow in vp8 encoding in libvpx CVE-2023-6345 (CVSS score: 9.6) - Integer overflow in Skia A total of 26,447 vulnerabilities have been disclosed so far in 2023, surpassing the previous year by over 1,500 CVEs, according to data compiled by Qualys, with 115 flaws exploited by threat actors and ransomware groups. Remote code execution, security feature bypass, buffer manipulation, privilege escalation, and input validation and parsing flaws emerged as the top vulnerability types. Users are recommended to upgrade to Chrome version 120.0.6099.129/130 for Windows and 120.0.6099.129 for macOS and Linux to mitigate potential threats. Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi are also advised to apply the fixes as and when they become available. https://thehackernews.com/2023/12/ur...8KBKb0yp0RoDtE __________________ SEO Connoisseur Microsoft Teams: Robert Warren SEO Telegram: @TheLegacy54 RobertWarrenSEO.com

12-22-2023, 07:42 AM	#2
CurrentlySober Too lazy to wipe my ass Industry Role: Join Date: Aug 2002 Location: A Public Bathroom Posts: 38,497	Updated both Windows & Mac OS - Cheers! I'd hate anyone to try and steal my poo! __________________ My AI Handywork... My Dream Gal... XXX 👁️ 👍️ 💩

12-22-2023, 12:15 PM	#5
Axeman Confirmed User Join Date: Feb 2004 Location: Swamp Posts: 5,201	Thx for the heads up. Forced the update. __________________ XXXRewards - Karups - Boyfun - Jawked. Paying on time since 1997. Contact me at brent [at] xxxrewards.com

12-22-2023, 01:04 PM	#6
lezinterracial Confirmed User Industry Role: Join Date: Jul 2012 Posts: 3,064	crazy. I figured their magic pointer would fix dangling pointers, would fix almost everything. I figured overflows wouldn't be a problem anymore either. __________________ Live Sex Shows

12-22-2023, 08:41 AM	#3
Klen Industry Role: Join Date: Aug 2006 Location: Little Vienna Posts: 32,235	Update done

12-22-2023, 10:58 AM	#4
Focus Last of a dying breed. Industry Role: Join Date: Jun 2004 Location: Canada Posts: 669	Done, and thanks for the heads up!