CVE-2017-15413: Incorrect Type Cast

Q: Who is exposed to this issue?

Users of affected Chromium-based browser installations, including the listed Debian, Red Hat, and Google Chrome products, are exposed when they browse to a crafted HTML page. Exploitation is remote and requires no attacker privileges.

Q: What interaction is required for exploitation?

The attacker must persuade a user to load a crafted HTML page. The vulnerability is in the browser's WebAssembly handling and may lead to heap corruption with high confidentiality, integrity, and availability impact.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 63.0.3239.84 are affected. The provided data does not specify fixed package versions for the listed Debian or Red Hat products.

Published Dec 7, 2017

Updated

A type confusion flaw was found in the WebAssembly component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=766666

External References:

https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html

Other sources

Type confusion in WebAssembly in V8 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Affected Software

7 affected componentsFixes available

debian/chromium-browser

redhat/chromium-browser<63.0.3239.84

63.0.3239.84

redhat Enterprise Linux Desktop=6.0

redhat Enterprise Linux Server=6.0

redhat Enterprise Linux Workstation=6.0

Debian Debian Linux=9.0

Google Chrome<63.0.3239.84

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 63.0.3239.84
Upgrade
Upgrade Google Chrome/Chromium to a version that resolves this vulnerability.
Fixed in 63.0.3239.84

Event History

Dec 7, 2017

Data Sourced

via Red Hat·09:53 AM

DescriptionSeverityAffected Software

Aug 28, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of affected Chromium-based browser installations, including the listed Debian, Red Hat, and Google Chrome products, are exposed when they browse to a crafted HTML page. Exploitation is remote and requires no attacker privileges.

What interaction is required for exploitation?

The attacker must persuade a user to load a crafted HTML page. The vulnerability is in the browser's WebAssembly handling and may lead to heap corruption with high confidentiality, integrity, and availability impact.

Which Chrome versions are affected?

Google Chrome versions prior to 63.0.3239.84 are affected. The provided data does not specify fixed package versions for the listed Debian or Red Hat products.

CVE-2017-15413: Incorrect Type Cast

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What interaction is required for exploitation?

Which Chrome versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What interaction is required for exploitation?

Which Chrome versions are affected?