Input validation error in Microsoft Edge - CVE-2023-21720

Vulnerability identifier: #VU71797

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-21720

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick the victim to visit a specially crafted website and crash the browser.

Microsoft Edge
Gentoo Linux
www-client/microsoft-edge
www-client/chromium
www-client/chromium-bin
www-client/google-chrome

Install update from vendor's website.

Microsoft Edge - update to 109.0.1518.78
www-client/microsoft-edge - update to 113.0.1774.50
www-client/chromium - update to 113.0.5672.126
www-client/chromium-bin - update to 113.0.5672.126
www-client/google-chrome - update to 113.0.5672.126

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-21720

• Denial of service in Microsoft Edge
• Gentoo update for Chromium, Google Chrome, Microsoft Edge