WebRTC · WebRTC
CVE-2022-2294
WebRTC Heap Buffer Overflow Vulnerability
What it is
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CISA: WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: September 15, 2022
- Added to the CISA list
- August 25, 2022
- Published
- July 28, 2022
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 71% in the top 0.6% of all known vulnerabilities
- Weakness
- CWE-122
- More details
- NVD · CVE.org · CISA
All references (8)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNI…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILD…
- https://security.gentoo.org/glsa/202208-35
- https://security.gentoo.org/glsa/202208-39
- https://security.gentoo.org/glsa/202311-11
- https://crbug.com/1341043
- https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.html
- http://www.openwall.com/lists/oss-security/2022/07/28/2
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.