The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5120 advisory.

  - Use after free in tab groups in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-1313)

  - Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2022-1305)

  - Inappropriate implementation in compositing in Google Chrome prior to 100.0.4896.88 allowed a remote     attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2022-1306)

  - Inappropriate implementation in full screen in Google Chrome on Android prior to 100.0.4896.88 allowed a     remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2022-1307)

  - Use after free in BFCache in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2022-1308)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DSA-5120-1 : chromium - security update

critical Nessus Plugin ID 159905

Version 1.6

Version 1.5

Version 1.4

Version 1.6 Nov 1, 2023, 1:41 PM Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 score source (changed from "CVE-2022-1313" to "CVE-2022-1314") Plugin Feed: 202311011341
Version 1.5 Mar 23, 2023, 8:46 PM Plugin requirements Plugin Feed: 202303232046
Version 1.4 Mar 21, 2023, 7:30 PM Plugin metadata Plugin Feed: 202303211930