AIKIDO-2024-10100
electron is vulnerable to Use-After-Free
75
High Risk
This Affects:
electronTL;DR
A use-after-free vulnerability in Dawn in Google Chrome prior to 125.0.6422.60 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
electron is vulnerable to Use-After-Free in versions 28.0.0 - 28.3.1 and 29.0.0 - 29.4.0.
How to fix this
Upgrade the electron library to the patch version.
Links
GitHub Release
Other
chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_15.htmlissues.chromium.org/issues/333414294lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTSN22LNYXMWHVTYNOYQVOY7VDZFHENQ/lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSUWM73ZCXTN62AT2REYQDD5ZKPFMDZD/
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.