The version of Microsoft Edge installed on the remote Windows host is prior to 116.0.1938.98 / 117.0.2045.47. It is, therefore, affected by multiple vulnerabilities as referenced in the September 29, 2023 advisory.

  - There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode()     function and loop through to free best.bw and assign best = trial pointer. The second loop will then     return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the     AddressSanitizer will attempt a double free. (CVE-2023-1999)

  - Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via crafted     UI interaction. (Chromium security severity: High) (CVE-2023-5186)

  - Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a     user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
    (Chromium security severity: High) (CVE-2023-5187)

  - Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1     allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium     security severity: High) (CVE-2023-5217)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Microsoft Edge (Chromium) < 116.0.1938.98 / 117.0.2045.47 Multiple Vulnerabilities

high Nessus Plugin ID 182419

Version 1.3

Version 1.2

Version 1.1

Version 1.1

Version 1.0

Version 1.3 Oct 23, 2023, 4:39 PM CVSSv2 score source (changed from "CVE-2023-5187" to "CVE-2023-5217") CVSSv3 score source (changed from "CVE-2023-5217" to "None") Plugin Feed: 202310231639
Version 1.2 Oct 21, 2023, 3:09 AM IAVM reference Plugin Feed: 202310210309
Version 1.1 Oct 6, 2023, 10:25 AM STIG Severity (set to "I") IAVM reference Plugin Feed: 202310061025
Version 1.1 Oct 21, 2023, 1:17 AM IAVM reference Plugin Feed: 202310210117
Version 1.0 Oct 2, 2023, 6:07 PM New Plugin Feed: 202310021807