CVE-2023-6704 Use after free in Chrome
A remote attacker can exploit heap corruption via a crafted image file to potentially execute arbitrary code in Google Chrome.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-6704?
CVE-2023-6704 is a high-severity use after free vulnerability in Google Chrome, published on 14 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted image file. (Chromium security severity: High)
Weakness: CWE-416
Which versions are affected by CVE-2023-6704?
It affects 1 product.
Linux distribution packages (9)
libavif SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 0.9.3-150400.3.3.1 |
libavif SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 0.9.3-150400.3.3.1 |
libavif SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 0.9.3-150400.3.3.1 |
libavif SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 0.9.3-150400.3.3.1 |
libavif SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 0.9.3-150400.3.3.1 |
libavif SUSE:Manager Proxy 4.3 | All versions | 0.9.3-150400.3.3.1 |
libavif SUSE:Manager Server 4.3 | All versions | 0.9.3-150400.3.3.1 |
libavif openSUSE:Leap 15.5 | All versions | 0.9.3-150400.3.3.1 |
libavif openSUSE:Tumbleweed | All versions | 1.0.3-1.1 |
Products include Google Chrome.
How do I fix CVE-2023-6704?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-6704 being exploited?
There is no known exploitation of CVE-2023-6704 in the wild and no public exploit code.
Other vulnerabilities in Google Chrome
Sources
Also known as DEBIAN-CVE-2023-6704, ECHO-2361-31e6-b714, GHSA-587x-fmc5-99p9, SUSE-SU-2024:0423-1, openSUSE-SU-2024:13534-1.