CVE-2017-5007: Heap overflow in V8. Credit to Gergely Nagy (Tresorit)
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled the sequence of events when closing a page, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 56.0.2924.76
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2017-5007?
CVE-2017-5007 is considered a high severity vulnerability allowing for UXSS attacks.
How do I fix CVE-2017-5007?
To fix CVE-2017-5007, upgrade Google Chrome to version 56.0.2924.76 or later.
What type of attacks can be executed using CVE-2017-5007?
CVE-2017-5007 can be exploited to inject arbitrary scripts or HTML into a user's browser session.
Which versions of Google Chrome are affected by CVE-2017-5007?
CVE-2017-5007 affects Google Chrome versions prior to 56.0.2924.76 for Linux, Windows, and Mac.
Can CVE-2017-5007 be exploited remotely?
Yes, CVE-2017-5007 can be exploited remotely via crafted HTML pages.