CVE-2019-13723: Use After Free

Reference Links

• https://chromereleases.googleblog.com/2019/11/stable-channel-update-for-desktop_18.html (Advisory)
• https://bugs.chromium.org/p/chromium/issues/detail?id=1024121
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1775341
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1775342
• https://chromium.googlesource.com/chromium/src.git/+/471ac08ef7cd7e66765829550fa232ca0062f34c
• https://access.redhat.com/errata/RHSA-2019:3955
• https://access.redhat.com/security/cve/cve-2019-13723
• https://bugzilla.redhat.com/show_bug.cgi?id=1775340
• http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00035.html
• https://crbug.com/1024121
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/54XWRJ5LDFL27QXBPIBX3EHO4TPMKN4R/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/USW7PGIHNPE6W3LGY6ZDFLELQGSL52CH/
• https://security.gentoo.org/glsa/202003-08
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/54XWRJ5LDFL27QXBPIBX3EHO4TPMKN4R/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/USW7PGIHNPE6W3LGY6ZDFLELQGSL52CH/

Parent vulnerabilities

(Appears in the following advisories)

• 4587363382154975342

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2019-13724

Frequently Asked Questions

• What is CVE-2019-13723?

  CVE-2019-13723 is a vulnerability in WebBluetooth in Google Chrome prior to version 78.0.3904.108 that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• How severe is CVE-2019-13723?

  CVE-2019-13723 has a severity rating of 8.8 (high).

• Which software versions are affected by CVE-2019-13723?

  Google Chrome versions prior to 78.0.3904.108, Fedora 30 and 31, OpenSUSE Backports sle-15, and Red Hat Enterprise Linux Desktop, Server, and Workstation version 6.0 are affected by CVE-2019-13723.

• How can an attacker exploit CVE-2019-13723?

  An attacker who has compromised the renderer process can exploit CVE-2019-13723 to potentially exploit heap corruption by using a crafted HTML page.

• Where can I find more information about CVE-2019-13723?

  You can find more information about CVE-2019-13723 in the following references: [Google Chrome Releases](https://chromereleases.googleblog.com/2019/11/stable-channel-update-for-desktop_18.html), [Chromium Bug Report](https://bugs.chromium.org/p/chromium/issues/detail?id=1024121), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1775341).