CVE-2022-4925
published 2023-07-29CVE-2022-4925: Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform header splitting via malicious…
PriorityP431medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EPSS
0.57%
43.7th percentile
Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform header splitting via malicious network traffic. (Chromium security severity: Low)
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | >= 0 < 97.0.4692.71-0.1~deb11u1 | 97.0.4692.71-0.1~deb11u1 |
| chromium | chromium | >= 0 < 97.0.4692.71-0.1 | 97.0.4692.71-0.1 |
| chromium | chromium | >= 0 < 97.0.4692.71-0.1 | 97.0.4692.71-0.1 |
| chromium | chromium | >= 0 < 97.0.4692.71-0.1 | 97.0.4692.71-0.1 |
| debian | chromium | < chromium 97.0.4692.71-0.1 (bookworm) | chromium 97.0.4692.71-0.1 (bookworm) |
| chrome | < 97.0.4692.71 | 97.0.4692.71 | |
| chrome | >= 97.0.4692.71 < 97.0.4692.71 | 97.0.4692.71 | |
| chrome_chrome | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
osv6.5MEDIUM
vendor_redhat7.8HIGH
vendor_debian6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
vim: buffer over-read in function find_next_quote
vendor_redhat·2022-05-10·CVSS 7.8
CVE-2022-1629 [HIGH] CWE-125 vim: buffer over-read in function find_next_quote
vim: buffer over-read in function find_next_quote
Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution
A flaw was found in vim, where it is vulnerable to a buffer over-read in the find_next_quote function. This flaw allows a specially crafted file to crash software, modify memory and possibly perform remote execution when opened in vim.
Statement: Red Hat Product Security has rated this issue as having a Low security impact, because the "victim" has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it.
For additional information, refe
Chrome
Stable Channel Update for Desktop: CVE-2022-0118
vendor_chrome·2022-01-04·CVSS 4.3
CVE-2022-0118 [LOW] Stable Channel Update for Desktop: CVE-2022-0118
Stable Channel Update for Desktop
CVE-2022-0118: Inappropriate implementation in WebShare. Reported by Alesandro Ortiz on 2021-08-11 [$TBD][ 1262953 ] Low CVE-2022-0120: Inappropriate implementation in Passwords
Reported by CHAKRAVARTHI (Ruler96) on 2021-10-25 [$1000][ 1238309 ] Low CVE-2022-4925: Insufficient validation of untrusted input in QUIC
Severity: low
Debian
CVE-2022-4925: chromium - Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97....
vendor_debian·2022·CVSS 6.5
CVE-2022-4925 [MEDIUM] CVE-2022-4925: chromium - Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97....
Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform header splitting via malicious network traffic. (Chromium security severity: Low)
Scope: local
bookworm: resolved (fixed in 97.0.4692.71-0.1)
bullseye: resolved (fixed in 97.0.4692.71-0.1~deb11u1)
forky: resolved (fixed in 97.0.4692.71-0.1)
sid: resolved (fixed in 97.0.4692.71-0.1)
trixie: resolved (fixed in 97.0.4692.71-0.1)
OSV
CVE-2022-4925: Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97
osv·2023-07-29·CVSS 6.5
CVE-2022-4925 [MEDIUM] CVE-2022-4925: Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97
Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform header splitting via malicious network traffic. (Chromium security severity: Low)
GHSA
GHSA-mc6p-cr25-crfc: Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97
ghsa_unreviewed·2023-07-29
CVE-2022-4925 [MEDIUM] CWE-20 GHSA-mc6p-cr25-crfc: Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97
Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform header splitting via malicious network traffic. (Chromium security severity: Low)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.htmlhttps://crbug.com/1238309https://lists.fedoraproject.org/archives/list/[email protected]/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.htmlhttps://crbug.com/1238309https://lists.fedoraproject.org/archives/list/[email protected]/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
2023-07-29
Published