CVE-2017-15417: Buffer Overflow

Q: What does an attacker need to exploit this issue?

An attacker needs to convince a user to visit a crafted HTML page. The attack is remote and does not require prior privileges.

Q: What information could be exposed?

The flaw can leak cross-origin data through inappropriate Skia canvas composite operations. The provided impact information indicates confidentiality impact only; integrity and availability are not affected.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 63.0.3239.84 are affected. The listed affected software also includes Chromium Browser packages for Debian and Red Hat Enterprise Linux Desktop, Server, and Workstation.

Published Dec 7, 2017

Updated

A cross origin information disclosure flaw was found in the Skia component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=699028

External References:

https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html

Other sources

Inappropriate implementation in Skia canvas composite operations in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Affected Software

7 affected componentsFixes available

debian/chromium-browser

redhat/chromium-browser<63.0.3239.84

63.0.3239.84

Google Chrome<63.0.3239.84

redhat Enterprise Linux Desktop=6.0

redhat Enterprise Linux Server=6.0

redhat Enterprise Linux Workstation=6.0

Debian Debian Linux=9.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 63.0.3239.84
Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 63.0.3239.84

Event History

Dec 7, 2017

Data Sourced

via Red Hat·09:53 AM

DescriptionSeverityAffected Software

Aug 28, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to convince a user to visit a crafted HTML page. The attack is remote and does not require prior privileges.

What information could be exposed?

The flaw can leak cross-origin data through inappropriate Skia canvas composite operations. The provided impact information indicates confidentiality impact only; integrity and availability are not affected.

Which Chrome versions are affected?

Google Chrome versions prior to 63.0.3239.84 are affected. The listed affected software also includes Chromium Browser packages for Debian and Red Hat Enterprise Linux Desktop, Server, and Workstation.

CVE-2017-15417: Buffer Overflow

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What information could be exposed?

Which Chrome versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What information could be exposed?

Which Chrome versions are affected?