CVE-2017-15411: Use After Free

Q: What interaction is required for exploitation?

Exploitation requires user interaction with a crafted PDF file. The attack can be delivered remotely and does not require attacker privileges.

Q: Which deployments are identified as relevant?

The affected software list includes Google Chrome and chromium-browser packages for Debian and Red Hat Enterprise Linux Desktop, Server, and Workstation.

Q: How can I identify an affected Google Chrome installation?

Google Chrome versions earlier than 63.0.3239.84 are affected. The provided data does not specify corresponding fixed package versions for the listed Debian or Red Hat products.

Published Dec 7, 2017

Updated

An use after free flaw was found in the PDFium component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=770148

External References:

https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html

Other sources

Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

Affected Software

7 affected componentsFixes available

debian/chromium-browser

redhat/chromium-browser<63.0.3239.84

63.0.3239.84

Google Chrome<63.0.3239.84

Debian Debian Linux=9.0

redhat Enterprise Linux Desktop=6.0

redhat Enterprise Linux Server=6.0

redhat Enterprise Linux Workstation=6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 63.0.3239.84
Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 63.0.3239.84

Event History

Dec 7, 2017

Data Sourced

via Red Hat·09:52 AM

DescriptionSeverityAffected Software

Aug 28, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Frequently Asked Questions

What interaction is required for exploitation?

Exploitation requires user interaction with a crafted PDF file. The attack can be delivered remotely and does not require attacker privileges.

Which deployments are identified as relevant?

The affected software list includes Google Chrome and chromium-browser packages for Debian and Red Hat Enterprise Linux Desktop, Server, and Workstation.

How can I identify an affected Google Chrome installation?

Google Chrome versions earlier than 63.0.3239.84 are affected. The provided data does not specify corresponding fixed package versions for the listed Debian or Red Hat products.

CVE-2017-15411: Use After Free

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What interaction is required for exploitation?

Which deployments are identified as relevant?

How can I identify an affected Google Chrome installation?

Company

Resources

Contact

Frequently Asked Questions

What interaction is required for exploitation?

Which deployments are identified as relevant?

How can I identify an affected Google Chrome installation?