CVE-2024-3839 — Out-of-bounds Read in Google Chrome

CWE-125 — Out-of-bounds ReadCWE-362 — Race Condition8 documents7 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 58.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Google ChromeChromiumDebian Chromium+2 more
Timeline
PublishedApr 17
Latest updateMay 17

Description

Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages6 packages

▶CVEListV5google/chrome124.0.6367.60 — 124.0.6367.60
▶NVDgoogle/chrome< 124.0.6367.60
▶debiandebian/chromium< chromium 124.0.6367.60-1~deb12u1 (bookworm)
▶Debianchromium/chromium< 124.0.6367.60-1~deb12u1+2

🔴Vulnerability Details

2
GHSA
GHSA-5mvp-3rph-rfxg: Out of bounds read in Fonts in Google Chrome prior to 124↗2024-04-17
▶
OSV
CVE-2024-3839: Out of bounds read in Fonts in Google Chrome prior to 124↗2024-04-17
▶

📋Vendor Advisories

4
Red Hat
kernel: usb: udc: remove warning when queue disabled ep↗2024-05-17
▶
Chrome
Stable Channel Update for Desktop: CVE-2024-3838↗2024-04-16
▶
Microsoft
Chromium: CVE-2024-3839 Out of bounds read in Fonts↗2024-04-09
▶
Debian
CVE-2024-3839: chromium - Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a re...↗2024
▶