TLP : CLEAR
Date : 31/05/2024
REF NO : CERT / 2024/05/52
Severity Level: Medium
Components Affected
Overview
A vulnerability was identified in Check Point Products. A remote attacker could exploit this vulnerability to trigger sensitive information disclosure on the targeted system.
Note:
The vulnerability CVE-2024-24919 is being used in scattered exploit. The vulnerability potentially allows an attacker to access information on Gateways connected to the Internet, with IPsec VPN, Remote Access VPN or Mobile Access enabled. The risk level is rated to Medium Risk.
Description
Recent security vulnerabilities in Google Chrome versions prior to 125.0.6422.141 have exposed users to various risks, primarily involving heap corruption and arbitrary code execution. A heap buffer overflow in WebRTC allowed remote attackers to potentially exploit heap corruption via a crafted HTML page. Multiple instances of use-after-free in Dawn enabled similar heap corruption exploits. Additionally, a use-after-free vulnerability in the Media Session component allowed remote attackers to execute arbitrary code inside a sandbox using a crafted HTML page. Out of bounds memory access in the browser’s UI could be exploited through specific UI gestures, leading to heap corruption. Further, use-after-free in the Presentation API and an out-of-bounds write in the Streams API both permitted remote attackers to exploit heap corruption and execute arbitrary code within a sandbox, respectively, all via crafted HTML pages. These vulnerabilities highlight the critical need for users to update to the latest versions to ensure security.
Impact
Solution/ Workarounds
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
Reference
Disclaimer : The information provided herein is on an “as is” basis, without warranty of any kind.
Sri Lanka Computer Emergency Readiness Team | Coordination Centre