Palo Alto Networks Security Advisories / PAN-SA-2024-0007

PAN-SA-2024-0007 Prisma Access Browser: Monthly Vulnerability Updates

Urgency MODERATE

047910
Severity 8.6 · HIGH
Response Effort LOW
Recovery AUTOMATIC
Value Density DIFFUSE
Attack Vector NETWORK
Attack Complexity LOW
Attack Requirements NONE
Automatable NO
User Interaction ACTIVE
Product Confidentiality HIGH
Product Integrity HIGH
Product Availability HIGH
Privileges Required NONE
Subsequent Confidentiality NONE
Subsequent Integrity NONE
Subsequent Availability NONE
JSON
Published 2024-08-14
Updated 2024-08-14
Discovered externally

Description

Prisma Access Browser (supersedes Talon Browser) has incorporated the latest upstream Chromium security fixes listed here:

- https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html

- https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html

- https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_30.html

- https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop.html

CVECVSSSummary
CVE-2024-67728.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Inappropriate implementation in V8.
CVE-2024-67738.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Type Confusion in V8.
CVE-2024-67748.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Use after free in Screen Capture.
CVE-2024-67758.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Use after free in Media Stream.
CVE-2024-67768.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Use after free in Audio.
CVE-2024-67778.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Use after free in Navigation.
CVE-2024-67788.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Race in DevTools.
CVE-2024-67798.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Out of bounds memory access in V8.
CVE-2024-69888.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Use after free in Downloads.
CVE-2024-69898.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Use after free in Loader.
CVE-2024-69908.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Uninitialized Use in Dawn.
CVE-2024-69918.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Use after free in Dawn.
CVE-2024-69948.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Heap buffer overflow in Layout.
CVE-2024-69954.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N)Chromium: Inappropriate implementation in Fullscreen.
CVE-2024-69963.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)Chromium: Race in Frames.
CVE-2024-69978.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Use after free in Tabs.
CVE-2024-69988.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Use after free in User Education.
CVE-2024-69994.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)Chromium: Inappropriate implementation in FedCM.
CVE-2024-70008.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Use after free in CSS.
CVE-2024-70014.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)Chromium: Inappropriate implementation in HTML.
CVE-2024-70034.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)Chromium: Inappropriate implementation in FedCM.
CVE-2024-70044.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)Chromium: Insufficient validation of untrusted input in Safe Browsing.
CVE-2024-70054.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)Chromium: Insufficient validation of untrusted input in Safe Browsing.
CVE-2024-7255Chromium: Out of bounds read in WebTransport.
CVE-2024-72568.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Insufficient data validation in Dawn.
CVE-2024-75328.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Out of bounds memory access in ANGLE.
CVE-2024-75338.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Use after free in Sharing.
CVE-2024-75348.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Heap buffer overflow in Layout.
CVE-2024-75358.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Inappropriate implementation in V8.
CVE-2024-75368.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Use after free in WebAudio.
CVE-2024-75508.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Chromium: Type Confusion in V8.

Product Status

VersionsAffectedUnaffected
Prisma Access Browser < 126.183.2844.1>= 127.100.2858.4

Severity: HIGH, Suggested Urgency: MODERATE

CVSS-B: 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Amber)

Solution

Prisma Access Browser 127.100.2858.4 (supersedes Talon Browser) and all later Prisma Access Browser versions contain the fix for all the listed CVEs.

Timeline

Clarified affected and unaffected versions
Initial publication
Terms of usePrivacyProduct Security Assurance and Vulnerability Disclosure PolicyReport vulnerabilitiesManage subscriptions
© 2024 Palo Alto Networks, Inc. All rights reserved.