CVE-2017-15418: Buffer Overflow

Q: What must an attacker do to exploit this issue?

An attacker must cause a user to load a crafted HTML page in an affected browser. The issue is remotely reachable and does not require attacker privileges, but it requires user interaction.

Q: What information could be exposed?

Successful exploitation may allow an attacker to obtain potentially sensitive information from the browser process memory. The provided data does not indicate integrity or availability impact.

Q: Which browser versions are affected?

Google Chrome versions prior to 63.0.3239.84 are affected. The listed affected software also includes Chromium Browser packages for Debian and Red Hat Enterprise Linux Desktop, Server, and Workstation.

Published Dec 7, 2017

Updated

An use of uninitialized value flaw was found in the Skia component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=765858

External References:

https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html

Other sources

Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

Affected Software

7 affected componentsFixes available

debian/chromium-browser

redhat/chromium-browser<63.0.3239.84

63.0.3239.84

Google Chrome<63.0.3239.84

redhat Enterprise Linux Desktop=6.0

redhat Enterprise Linux Server=6.0

redhat Enterprise Linux Workstation=6.0

Debian Debian Linux=9.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 63.0.3239.84
Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 63.0.3239.84

Event History

Dec 7, 2017

Data Sourced

via Red Hat·09:53 AM

DescriptionSeverityAffected Software

Aug 28, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

An attacker must cause a user to load a crafted HTML page in an affected browser. The issue is remotely reachable and does not require attacker privileges, but it requires user interaction.

What information could be exposed?

Successful exploitation may allow an attacker to obtain potentially sensitive information from the browser process memory. The provided data does not indicate integrity or availability impact.

Which browser versions are affected?

Google Chrome versions prior to 63.0.3239.84 are affected. The listed affected software also includes Chromium Browser packages for Debian and Red Hat Enterprise Linux Desktop, Server, and Workstation.

CVE-2017-15418: Buffer Overflow

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

What information could be exposed?

Which browser versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

What information could be exposed?

Which browser versions are affected?