CVE-2017-15415: Buffer Overflow

Q: What must an attacker do to exploit this issue?

The attacker must persuade a user to visit a crafted HTML page. The vulnerability is remotely reachable and requires no attacker privileges, but user interaction is required.

Q: What information could be exposed?

Successful exploitation can disclose the value of a pointer through incorrect IPC serialization. The provided impact data indicates high confidentiality impact, with no integrity or availability impact.

Q: Which browser versions need remediation?

Google Chrome versions before 63.0.3239.84 are affected. The listed affected software also includes Chromium Browser packages for Debian and Red Hat Enterprise Linux Desktop, Server, and Workstation.

Published Dec 7, 2017

Updated

A pointer information disclosure flaw was found in the IPC call component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=765512

External References:

https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html

Other sources

Incorrect serialization in IPC in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the value of a pointer via a crafted HTML page.

Affected Software

7 affected componentsFixes available

debian/chromium-browser

redhat/chromium-browser<63.0.3239.84

63.0.3239.84

Debian Debian Linux=9.0

redhat Enterprise Linux Desktop=6.0

redhat Enterprise Linux Server=6.0

redhat Enterprise Linux Workstation=6.0

Google Chrome<63.0.3239.84

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 63.0.3239.84
Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 63.0.3239.84

Event History

Dec 7, 2017

Data Sourced

via Red Hat·09:53 AM

DescriptionSeverityAffected Software

Aug 28, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker must persuade a user to visit a crafted HTML page. The vulnerability is remotely reachable and requires no attacker privileges, but user interaction is required.

What information could be exposed?

Successful exploitation can disclose the value of a pointer through incorrect IPC serialization. The provided impact data indicates high confidentiality impact, with no integrity or availability impact.

Which browser versions need remediation?

Google Chrome versions before 63.0.3239.84 are affected. The listed affected software also includes Chromium Browser packages for Debian and Red Hat Enterprise Linux Desktop, Server, and Workstation.

CVE-2017-15415: Buffer Overflow

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

What information could be exposed?

Which browser versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

What information could be exposed?

Which browser versions need remediation?