Vulnerability Details : CVE-2023-7024
Potential exploit
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Vulnerability category: Overflow
Products affected by CVE-2023-7024
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
CVE-2023-7024 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Google Chromium WebRTC Heap Buffer Overflow Vulnerability
CISA required action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA description:
Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, i
Notes:
This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-d
Added on
2024-01-02
Action due date
2024-01-23
Exploit prediction scoring system (EPSS) score for CVE-2023-7024
44.53%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-7024
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2025-02-03 |
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2023-7024
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2023-7024
-
https://security.gentoo.org/glsa/202401-34
Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities (GLSA 202401-34) — Gentoo securityThird Party Advisory
-
https://crbug.com/1513170
Sign in - Google AccountsExploit;Issue Tracking
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6M6AJDHUL6EDPURWQXGLUFJNDE7SOJT3/
[SECURITY] Fedora 38 Update: chromium-120.0.6099.129-1.fc38 - package-announce - Fedora Mailing-ListsMailing List
-
https://www.debian.org/security/2023/dsa-5585
Debian -- Security Information -- DSA-5585-1 chromiumMailing List
-
https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html
Chrome Releases: Stable Channel Update for DesktopVendor Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6JL4VHZMHFGEGQYTF74533ZNRWMCMMR/
[SECURITY] Fedora 39 Update: chromium-120.0.6099.129-1.fc39 - package-announce - Fedora Mailing-ListsMailing List
Jump to