Bug 2280589 (CVE-2024-4761)

Summary:	CVE-2024-4761 chromium-browser: Out of bounds write in V8
Product:	[Other] Security Response	Reporter:	Rohit Keshri <rkeshri>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	chromium 124.0.6367.207	Doc Type:	If docs needed, set a value
Doc Text:	An out-of-bounds write vulnerability was found in the Chromium web browser. If a remote, unauthenticated attacker tricks a user into visiting a specially crafted HTML page, the attacker could write to memory, which is out of bounds. This issue could have impacts to integrity, availability, and confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-06-08 16:21:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2280590, 2280591
Bug Blocks:	2280983

Description Rohit Keshri 2024-05-15 10:31:02 UTC

Upstream just released a security fix
https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html

As Google is aware that an exploit exists in the wild, I submit update even if Chromium 125 package update should be ready by next week.

Comment 1 Rohit Keshri 2024-05-15 10:31:27 UTC

Created chromium tracking bugs for this issue:

Affects: epel-all [bug 2280590]
Affects: fedora-all [bug 2280591]