CVE-2017-15403: Interested in switching channels? Find out how. You can submit feedback using ‘Report an issue...’ in the Chrome menu (3 vertical dots in the upper right corner of the browser).
Published Oct 5, 2017
·Updated
Insufficient data validation in crosh could lead to a command injection under chronos privileges in Networking in Google Chrome on Chrome OS prior to 61.0.3163.113 allowed a local attacker to execute arbitrary code via a crafted HTML page.
Affected Software
3 affected componentsFixes available
Google Chrome<61.0.3163.113
Google Chrome OS
Google Chrome OS<61.0.3163.113
61.0.3163.113
Remediation
Patch Available
Event History
Oct 5, 2017
CVE Published
12:00 AM
Data Sourced
12:00 AM
WeaknessAffected Software
Jan 9, 2019
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-15403?
CVE-2017-15403 is classified as a high-severity vulnerability due to its potential for command injection under chronos privileges.
2
How do I fix CVE-2017-15403?
To fix CVE-2017-15403, update Google Chrome to version 61.0.3163.113 or later.
3
Who is affected by CVE-2017-15403?
Local attackers on Google Chrome versions prior to 61.0.3163.113 on Chrome OS are affected by CVE-2017-15403.
4
What could an attacker achieve with CVE-2017-15403?
An attacker exploiting CVE-2017-15403 could execute arbitrary code on the affected system.
5
What is the nature of CVE-2017-15403?
CVE-2017-15403 involves insufficient data validation in crosh, leading to a potential security breach.