Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2024-1283: Chromium on Debian may corrupt memory via malicious webpage
CVE-2024-1283 · published 2 years ago
Summary
The Chromium browser packaged for Debian can be tricked by a specially crafted web page into overwriting its own memory. This can let an attacker cause the program to behave incorrectly or potentially take control of it. Update Chromium to the latest version provided by Debian to protect against this risk.
What to do
- Update debian chromium to version 121.0.6167.160-1~deb12u1.
- Update debian chromium to version 121.0.6167.160-1.
- Update google chrome to version 121.0.6167.160 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | chromium |
< 121.0.6167.160-1~deb12u1 Fix: upgrade to 121.0.6167.160-1~deb12u1
|
| Debian:13 | debian | chromium |
< 121.0.6167.160-1 Fix: upgrade to 121.0.6167.160-1
|
| Debian:14 | debian | chromium |
< 121.0.6167.160-1 Fix: upgrade to 121.0.6167.160-1
|
| – | chrome |
< 121.0.6167.160 cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
|
| – | fedoraproject | fedora |
38 39 cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
Original advisory text
Heap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Heap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
References
- https://security-tracker.debian.org/tracker/CVE-2024-1283 Vendor Advisory
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop.... Release Notes Vendor Advisory
- https://issues.chromium.org/issues/41494860 Permissions Required
- https://lists.fedoraproject.org/archives/list/[email protected]... Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]... Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
9.8
Critical
Type
CWE-787Out-of-bounds Write
CWE-122Heap-based Buffer Overflow
Timeline
Published7 Feb 2024
Updated15 Oct 2026
First seen15 Sep 2026
Track software like this
Free during beta