CVE-2022-3051
published 2022-09-26CVE-2022-3051: Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in…
PriorityP343high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.68%
48.8th percentile
Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | >= 0 < 105.0.5195.52-1~deb11u1 | 105.0.5195.52-1~deb11u1 |
| chromium | chromium | >= 0 < 105.0.5195.52-1 | 105.0.5195.52-1 |
| chromium | chromium | >= 0 < 105.0.5195.52-1 | 105.0.5195.52-1 |
| chromium | chromium | >= 0 < 105.0.5195.52-1 | 105.0.5195.52-1 |
| debian | chromium | < chromium 105.0.5195.52-1 (bookworm) | chromium 105.0.5195.52-1 (bookworm) |
| fedoraproject | fedora | — | — |
| chrome | < 105.0.5195.52 | 105.0.5195.52 | |
| chrome | >= unspecified < 105.0.5195.52 | 105.0.5195.52 | |
| chrome_chrome | — | — | |
| plone | volto | >= 14.0.0-alpha.6 < 15.0.0-alpha.0 | 15.0.0-alpha.0 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mrhr-c569-5wjh: Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105
ghsa_unreviewed·2022-09-27
CVE-2022-3051 [HIGH] CWE-787 GHSA-mrhr-c569-5wjh: Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105
Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
OSV
CVE-2022-3051: Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105
osv·2022-09-26·CVSS 8.8
CVE-2022-3051 [HIGH] CVE-2022-3051: Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105
Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
GHSA
Sudden swap of user auth tokens in Volto
ghsa·2022-03-14
CVE-2022-24740 [MEDIUM] CWE-287 Sudden swap of user auth tokens in Volto
Sudden swap of user auth tokens in Volto
### Impact
Due to the usage of an outdated version of the react-cookie library, under the circumstances of given a server high load, it is possible that a user could get his/her auth cookie replaced with the auth cookie from another user, effectively giving him full access to the other users account and privileges. A proven exploit for this vulnerability does not exist, since the exact requisites for it to happen have not been fully clarified, and the attempts to reproduce it under testing conditions have been unsuccessful, but it still can happen randomly and unintentionally in the wild.
### Patches
The patch and fix is present in Volto 15.0.0-alpha.0 (or later). See PR: https://github.com/plone/volto/pull/3051.
We recommend upgrading to the fina
Chrome
Stable Channel Update for Desktop: CVE-2022-3049
vendor_chrome·2022-08-30·CVSS 8.8
CVE-2022-3049 [MEDIUM] Stable Channel Update for Desktop: CVE-2022-3049
Stable Channel Update for Desktop
CVE-2022-3049: Use after free in SplitScreen. Reported by @ginggilBesel on 2022-04-17 [$3000][ 1337132 ] Medium CVE-2022-3050: Heap buffer overflow in WebUI
Reported by Zhihua Yao of KunLun Lab on 2022-06-17 [$2000][ 1345245 ] Medium CVE-2022-3051: Heap buffer overflow in Exosphere
Severity: medium
Debian
CVE-2022-3051: chromium - Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to...
vendor_debian·2022·CVSS 8.8
CVE-2022-3051 [HIGH] CVE-2022-3051: chromium - Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to...
Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
Scope: local
bookworm: resolved (fixed in 105.0.5195.52-1)
bullseye: resolved (fixed in 105.0.5195.52-1~deb11u1)
forky: resolved (fixed in 105.0.5195.52-1)
sid: resolved (fixed in 105.0.5195.52-1)
trixie: resolved (fixed in 105.0.5195.52-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.htmlhttps://crbug.com/1345245https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/https://security.gentoo.org/glsa/202209-23https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.htmlhttps://crbug.com/1345245https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/https://security.gentoo.org/glsa/202209-23
2022-09-26
Published