The version of Microsoft Edge installed on the remote Windows host is prior to 118.0.2088.122 / 119.0.2151.97. It is, therefore, affected by multiple vulnerabilities as referenced in the November 29, 2023 advisory.

  - Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium     security severity: High) (CVE-2023-6345)

  - Use after free in WebAudio in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-6346)

  - Use after free in Mojo in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-6347)

  - Type Confusion in Spellcheck in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium     security severity: High) (CVE-2023-6348)

  - Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to     potentially exploit heap corruption via a crafted avif file. (Chromium security severity: High)     (CVE-2023-6350, CVE-2023-6351)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-145f259a77 advisory.

    update to 119.0.6045.199, upstream security release

    High CVE-2023-6348: Type Confusion in Spellcheck

    High CVE-2023-6347: Use after free in Mojo

    High CVE-2023-6346: Use after free in WebAudio

    High CVE-2023-6350: Out of bounds memory access in libavif

    High CVE-2023-6351: Use after free in libavif

    High CVE-2023-6345: Integer overflow in Skia



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5569 advisory.

    Multiple security issues were discovered in Chromium, which could result in the execution of arbitrary     code, denial of service or information disclosure. For the oldstable distribution (bullseye), these     problems have been fixed in version 119.0.6045.199-1~deb11u1. For the stable distribution (bookworm),     these problems have been fixed in version 119.0.6045.199-1~deb12u1. We recommend that you upgrade your     chromium packages. For the detailed security status of chromium please refer to its security tracker page     at: https://security-tracker.debian.org/tracker/chromium

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ceaa6b19c1 advisory.

    update to 119.0.6045.199, upstream security release

    * High CVE-2023-6345: Integer overflow in Skia
    * High CVE-2023-6346: Use after free in WebAudio
    * High CVE-2023-6347: Use after free in Mojo
    * High CVE-2023-6348: Type Confusion in Spellcheck
    * High CVE-2023-6350: Out of bounds memory access in libavif
    * High CVE-2023-6351: Use after free in libavif


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0397-1 advisory.

  - Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium     security severity: High) (CVE-2023-6345)

  - Use after free in WebAudio in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-6346)

  - Use after free in Mojo in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-6347)

  - Type Confusion in Spellcheck in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium     security severity: High) (CVE-2023-6348)

  - Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to     potentially exploit heap corruption via a crafted avif file. (Chromium security severity: High)     (CVE-2023-6350, CVE-2023-6351)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0396-1 advisory.

  - Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium     security severity: High) (CVE-2023-6345)

  - Use after free in WebAudio in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-6346)

  - Use after free in Mojo in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-6347)

  - Type Confusion in Spellcheck in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium     security severity: High) (CVE-2023-6348)

  - Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to     potentially exploit heap corruption via a crafted avif file. (Chromium security severity: High)     (CVE-2023-6350, CVE-2023-6351)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
186447	Microsoft Edge (Chromium) < 118.0.2088.122 / 119.0.2151.97 Multiple Vulnerabilities	Nessus	Windows	2023/11/29	2026/6/16	critical
186456	Fedora 39 : chromium (2023-145f259a77)	Nessus	Fedora Local Security Checks	2023/11/29	2024/11/14	critical
186514	Debian DSA-5569-1 : chromium - security update	Nessus	Debian Local Security Checks	2023/12/1	2025/1/24	critical
186596	Fedora 37 : chromium (2023-ceaa6b19c1)	Nessus	Fedora Local Security Checks	2023/12/5	2024/11/14	critical
186748	openSUSE 15 Security Update : opera (openSUSE-SU-2023:0397-1)	Nessus	SuSE Local Security Checks	2023/12/12	2023/12/12	critical
186749	openSUSE 15 Security Update : opera (openSUSE-SU-2023:0396-1)	Nessus	SuSE Local Security Checks	2023/12/12	2023/12/12	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical