CVE-2024-9602
Google Chrome V8 Type Confusion Memory Corruption
Description
Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
INFO
Published Date :
Oct. 8, 2024, 11:15 p.m.
Last Modified :
Oct. 10, 2024, 12:51 p.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
5.9
Exploitability Score :
2.8
Public PoC/Exploit Available at Github
CVE-2024-9602 has a 1 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-9602.
| URL | Resource |
|---|---|
| https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_8.html | |
| https://issues.chromium.org/issues/368241697 |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-9602 vulnerability anywhere in the article.
-
Cybersecurity News
Apache ZooKeeper Security Alert: Important Flaw Impacts Admin Server (CVE-2024-51504)
Apache ZooKeeper, the widely used centralized service for managing configuration and synchronization across distributed applications, has recently issued a security advisory regarding a significant vu ... Read more
-
Cybersecurity News
Obfuscated JavaScript and WebDAV: Strela Stealer’s New Tools for Credential Theft
Phishing Email | Image: CRILA recent report from Cyble Research and Intelligence Labs (CRIL) highlights a sophisticated phishing campaign deploying Strela Stealer, a malware designed to exfiltrate sen ... Read more
-
Cybersecurity News
Six Vulnerabilities Uncovered in Ollama: Risks of AI Model Theft and Poisoning
10K unique internet-facing IPs that run Ollama | Image: OligoOligo’s research team recently unveiled six vulnerabilities in Ollama, a popular open-source framework for running large language models (L ... Read more
-
Cybersecurity News
CVE-2024-10392 (CVSS 9.8): Popular WordPress AI Plugin Exposed to Critical Security Risk
Website owners using the AI Power: Complete AI Pack plugin are urged to update to the latest version immediately to patch a critical vulnerability that could lead to complete site takeover.The flaw, t ... Read more
-
Cybersecurity News
BackBox Linux 9 “Noble Numbat” Released
The BackBox Team has just unleashed the latest iteration of their popular penetration testing and security auditing platform, BackBox Linux 9, codenamed “Noble Numbat.” This release is packed with upd ... Read more
-
Cybersecurity News
Hikvision HikCentral Master Lite and Professional Affected by Multi Vulnerabilities
Hikvision, a leading provider of AIoT and video surveillance solutions, has disclosed three vulnerabilities affecting its HikCentral Master Lite and HikCentral Professional software. These flaws could ... Read more
-
Cybersecurity News
Popular Java Security Framework ‘pac4j’ Vulnerable to RCE (CVE-2023-25581)
A new analysis by security researcher Michael Stepankin (@artsploit) of the GitHub Security Lab (GHSL) has uncovered a critical vulnerability in pac4j, a widely-used Java security framework. This vuln ... Read more
-
Cybersecurity News
Google Pays $55,000 Bounty for Chrome Security Flaw
Google has released a Stable Channel update for Chrome on Windows, Mac, and Linux, bringing the browser to version 129.0.6668.100/.101. The update is expected to roll out over the next few days and in ... Read more
The following table lists the changes that have been made to the
CVE-2024-9602 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 09, 2024
Action Type Old Value New Value Added CWE CISA-ADP CWE-843 Added CWE CISA-ADP CWE-787 Added CVSS V3.1 CISA-ADP AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H -
CVE Received by [email protected]
Oct. 08, 2024
Action Type Old Value New Value Added Description Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High) Added Reference Chrome https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_8.html [No types assigned] Added Reference Chrome https://issues.chromium.org/issues/368241697 [No types assigned] Added CWE Chrome CWE-843
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-9602 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-9602
weaknesses.