Actively exploited · Published Nov 29, 2023 · Assigned by Chrome
CVE-2023-6345
Critical 9.6 Exploited
In plain English
A critical-severity integer overflow in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on November 30, 2023). The chance it is exploited in the next 30 days is estimated at 16.5% (higher than 97% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Dec 21, 2023.
Official description
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | qt5-qtwebengine | 5.15.16-r3 | ALPINE-CVE-2023-6345 |
| Alpine:v3.21 | qt5-qtwebengine | 5.15.16-r3 | ALPINE-CVE-2023-6345 |
| Alpine:v3.22 | qt5-qtwebengine | 5.15.16-r3 | ALPINE-CVE-2023-6345 |
| Alpine:v3.23 | qt5-qtwebengine | 5.15.16-r3 | ALPINE-CVE-2023-6345 |
| Alpine:v3.20 | qt6-qtwebengine | 6.6.1-r1 | ALPINE-CVE-2023-6345 |
| Alpine:v3.21 | qt6-qtwebengine | 6.6.1-r1 | ALPINE-CVE-2023-6345 |
| Alpine:v3.22 | qt6-qtwebengine | 6.6.1-r1 | ALPINE-CVE-2023-6345 |
| Alpine:v3.23 | qt6-qtwebengine | 6.6.1-r1 | ALPINE-CVE-2023-6345 |
| Alpine:v3.24 | qt6-qtwebengine | 6.6.1-r1 | ALPINE-CVE-2023-6345 |
| Debian:12 | chromium | 119.0.6045.199-1~deb12u1 | DEBIAN-CVE-2023-6345 |
| Debian:12 | chromium | 119.0.6045.199-1~deb12u1 | DSA-5569-1 |
| Debian:13 | chromium | 119.0.6045.199-1 | DEBIAN-CVE-2023-6345 |
| Debian:14 | chromium | 119.0.6045.199-1 | DEBIAN-CVE-2023-6345 |
Affected products (as reported)
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html
- https://crbug.com/1505053
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJROPNKWW65R34J4IYGTJ7A3OBPUL4IQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T7ABNYMOI4ZHVCSPCNP7HQTOLGF53A2/
- https://www.debian.org/security/2023/dsa-5569
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C7XQNYZZA3X2LBJF57ZHKXWOMJKNLZYR/
- https://security.gentoo.org/glsa/202401-34
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6345 government-resource