INFESA-2024:0005: chromium security update (Important)

Information about definition

Identificator: INFESA-2024:0005

Type: security

Release date: 2024-09-20 19:14:52 UTC

Information about package

Chromium is an open-source web browser, powered by WebKit (Blink)

Vulnerabilities description

  • CVE-2024-8904

    Type Confusion in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  • CVE-2024-8905

    Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: Medium)

  • CVE-2024-8906

    Incorrect security UI in Downloads in Google Chrome prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

  • CVE-2024-8908

    Inappropriate implementation in Autofill in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

  • CVE-2024-8909

    Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

  • CVE-2024-8907

    Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (XSS) via a crafted set of UI gestures. (Chromium security severity: Medium)

Severity level

CVE Score CVSS 2.0 Score CVSS 3.x Score CVSS 4.0
NIST — CVE-2024-8904
 no information 8.8 no information
NIST — CVE-2024-8905
 no information 8.8 no information
NIST — CVE-2024-8906
 no information no information no information
NIST — CVE-2024-8907
 no information no information no information
NIST — CVE-2024-8908
 no information no information no information
NIST — CVE-2024-8909
 no information no information no information
Critical, important, moderate, low

Updated packages