WebRTC

2023年6月14日

SecurityWeek铬114更新补丁关键漏洞谷歌发布了Chrome 114安全更新地址五漏洞,包括自动填充critical-severity错误付款。114年谷歌周二宣布了一项新的Chrome更新解决五个漏洞,包括四个关键——和安全性bug报告的外部人员。其中最重要的问题是cve - 2023 - 3214,一个关键use-after-free缺陷自动填充支付。问题是报道VRI荣剑,谷歌在其顾问指出。Use-after-free漏洞是一种内存泄露错误发生在当一个指针不清除内存分配后释放。这些缺陷可能被利用来实现远程代码执行(远端控制设备),拒绝服务(DoS),或数据损坏,甚至可能导致完整的系统妥协,如果加上其他错误。在Chrome,成功开发use-after-free漏洞可能导致一个沙箱逃脱,如果攻击者可以目标特权铬过程或底层操作系统的一个缺陷。除了cve - 2023 - 3214,最新的Chrome更新解决了两个其他use-after-free问题,都认为“高严重性”:cve - 2023 - 3215,影响WebRTC, cve - 2023 - 3217,影响WebXR。第四外部报告缺陷解决这个浏览器版本是一种困惑问题的V8 JavaScript引擎。广告。 Scroll to continue reading. Google says it paid out $3,000 for the WebRTC vulnerability, but has yet to determine the amounts to be paid for the Autofill payments and V8 bugs. The WebXR flaw was reported by Sergei Glazunov of Google Project Zero and, per Google’s policy, no bug bounty reward will be issued for this security defect. Google makes no mention of any of these vulnerabilities being exploited in attacks. The latest Chrome iteration is now rolling out as version 14.0.5735.133 for macOS and Linux, and as versions 114.0.5735.133/134 for Windows. The new browser release arrives roughly one week after Google pushed an emergency Chrome update to address an exploited zero-day vulnerability , the third zero-day found in the browser since the beginning of the year.