Bug 920442 (CVE-2023-7024) – <www-client/{chromium,google-chrome}-120.0.6099.129 <www-client/microsoft-edge-120.0.2210.91: WebRTC heap buffer overflow

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Sam James 2023-12-21 07:11:39 UTC]

"""
[$NA][1513170] High CVE-2023-7024: Heap buffer overflow in WebRTC. Reported by Clément Lecigne and Vlad Stolyarov of Google's Threat Analysis Group on 2023-12-19

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Google is aware that an exploit for CVE-2023-7024 exists in the wild. 
"""

[Comment 1 Sam James 2023-12-21 10:29:13 UTC]

*** Bug 920473 has been marked as a duplicate of this bug. ***

[Comment 2 Larry the Git Cow 2023-12-22 05:07:41 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b054777e0208075b98c2a4e337aae17255196563

commit b054777e0208075b98c2a4e337aae17255196563
Author:     Matt Jolly <[e-mail]>
AuthorDate: 2023-12-21 22:07:36 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-12-22 05:04:38 +0000

    www-client/chromium: add 120.0.6099.129
    
    Bug: https://bugs.gentoo.org/920442
    Signed-off-by: Matt Jolly <[e-mail]>
    Signed-off-by: Sam James <[e-mail]>

 www-client/chromium/Manifest                       |    2 +
 www-client/chromium/chromium-120.0.6099.129.ebuild | 1269 ++++++++++++++++++++
 2 files changed, 1271 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7849241d61cd17214ec6cd2efaa6c804bf0b35fd

commit 7849241d61cd17214ec6cd2efaa6c804bf0b35fd
Author:     Matt Jolly <[e-mail]>
AuthorDate: 2023-12-21 21:51:49 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-12-22 05:01:42 +0000

    www-client/google-chrome: automated update (120.0.6099.129)
    
    Bug: https://bugs.gentoo.org/920442
    Signed-off-by: Matt Jolly <[e-mail]>
    Signed-off-by: Sam James <[e-mail]>

 www-client/google-chrome/Manifest                                       | 2 +-
 ...chrome-120.0.6099.109.ebuild => google-chrome-120.0.6099.129.ebuild} | 0
 2 files changed, 1 insertion(+), 1 deletion(-)

[Comment 3 Larry the Git Cow 2024-01-31 15:40:03 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=8064a0b694d29fb2fca491d65494098fb43c2ffa

commit 8064a0b694d29fb2fca491d65494098fb43c2ffa
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-01-31 15:39:13 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-01-31 15:39:35 +0000

    [ GLSA 202401-34 ] Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/907999
    Bug: https://bugs.gentoo.org/908471
    Bug: https://bugs.gentoo.org/909283
    Bug: https://bugs.gentoo.org/910522
    Bug: https://bugs.gentoo.org/911675
    Bug: https://bugs.gentoo.org/912364
    Bug: https://bugs.gentoo.org/913016
    Bug: https://bugs.gentoo.org/913710
    Bug: https://bugs.gentoo.org/914350
    Bug: https://bugs.gentoo.org/914871
    Bug: https://bugs.gentoo.org/915137
    Bug: https://bugs.gentoo.org/915560
    Bug: https://bugs.gentoo.org/915961
    Bug: https://bugs.gentoo.org/916252
    Bug: https://bugs.gentoo.org/916620
    Bug: https://bugs.gentoo.org/917021
    Bug: https://bugs.gentoo.org/917357
    Bug: https://bugs.gentoo.org/918882
    Bug: https://bugs.gentoo.org/919321
    Bug: https://bugs.gentoo.org/919802
    Bug: https://bugs.gentoo.org/920442
    Bug: https://bugs.gentoo.org/921337
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202401-34.xml | 229 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 229 insertions(+)