CVE-2017-5053: Critical severity Google Chrome vulnerability

Q: Which Chrome versions are affected?

Google Chrome versions before 57.0.2987.133 on Linux, Windows, and Mac are affected. Android Chrome versions before 57.0.2987.132 are affected.

Q: What does an attacker need to exploit this issue?

An attacker can trigger the flaw remotely by getting a user to load a crafted HTML page. No attacker authentication or pre-existing privileges are indicated.

Q: What is the potential impact of successful exploitation?

Successful exploitation can allow arbitrary code execution inside the browser sandbox. The supplied severity vector indicates high confidentiality, integrity, and availability impact, with scope changed.

Published Mar 30, 2017

Updated

An out of bounds memory access flaw was found in the V8 component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=702058

External References:

https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop29.html

Other sources

An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to Array.prototype.indexOf.

— MITRE

Affected Software

10 affected componentsFixes available

redhat/chrome<57.0.2987.133

57.0.2987.133

Google Chrome<57.0.2987.133

Apple macOS

Linux Linux kernel

Microsoft Windows

Google Chrome<57.0.2987.132

Google Android

redhat Enterprise Linux Desktop=6.0

redhat Enterprise Linux Server=6.0

redhat Enterprise Linux Workstation=6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/Chrome to a version that resolves this vulnerability.
Fixed in 57.0.2987.133
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 57.0.2987.133
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 57.0.2987.132

Event History

Mar 30, 2017

Data Sourced

via Red Hat·07:48 AM

DescriptionSeverityAffected Software

Oct 27, 2017

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

DescriptionWeakness

Frequently Asked Questions

Which Chrome versions are affected?

Google Chrome versions before 57.0.2987.133 on Linux, Windows, and Mac are affected. Android Chrome versions before 57.0.2987.132 are affected.

What does an attacker need to exploit this issue?

An attacker can trigger the flaw remotely by getting a user to load a crafted HTML page. No attacker authentication or pre-existing privileges are indicated.

What is the potential impact of successful exploitation?

Successful exploitation can allow arbitrary code execution inside the browser sandbox. The supplied severity vector indicates high confidentiality, integrity, and availability impact, with scope changed.

CVE-2017-5053: Critical severity Google Chrome vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Chrome versions are affected?

What does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which Chrome versions are affected?

What does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?