CVE-2023-6345 Google Skia Integer Overflow
A remote attacker with compromised renderer access can escape the sandbox via an integer overflow in Skia, requiring a browser upgrade.
- Exploited in the wild
- Since 30 Nov 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-6345?
CVE-2023-6345 is a critical vulnerability in Debian Debian Linux, published on 29 Nov 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
Weakness: CWE-190
Which versions are affected by CVE-2023-6345?
It affects 4 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Google Chrome, Microsoft Edge Chromium.
How do I fix CVE-2023-6345?
Upgrade to a fixed version. US federal agencies must fix it by 21 Dec 2023.
Is CVE-2023-6345 being exploited?
Yes. Attackers have exploited CVE-2023-6345 in the wild since at least 30 Nov 2023.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2023-6345, GHSA-xm5p-7w7v-qqr5.