CVE-2017-15419: Medium severity redhat Enterprise Linux Desktop vulnerability
A cross origin leak of redirect url flaw was found in the Blink component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=780312
External References:
https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
Other sources
Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to infer browsing history by triggering a leaked cross-origin URL via a crafted HTML page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/chromium-browserto a version that resolves this vulnerability.Fixed in 63.0.3239.84 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 63.0.3239.84
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15419?
CVE-2017-15419 has a medium severity rating due to its potential to allow cross-origin leaks of redirect URLs.
How do I fix CVE-2017-15419?
To fix CVE-2017-15419, update your Chromium browser to version 63.0.3239.84 or later.
What software is affected by CVE-2017-15419?
CVE-2017-15419 affects Chromium browsers on Debian and Red Hat Enterprise Linux systems.
What type of vulnerability is CVE-2017-15419?
CVE-2017-15419 is identified as a cross-origin leak vulnerability in the Blink component of the Chromium browser.
Is CVE-2017-15419 still a risk?
CVE-2017-15419 may still pose a risk if users do not update their browsers to the patched version.