CVE-2017-5078: Command Injection
A possible command injection flaw was found in the mailto handling component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=711020
External References:
https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html
Other sources
Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as have an incorrect interaction with xdg-email in xdg-utils, and a space character can be used in front of a command-line argument.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5078?
CVE-2017-5078 is classified as a medium severity vulnerability due to its potential for command injection attacks.
How do I fix CVE-2017-5078?
To fix CVE-2017-5078, update Google Chrome to version 59.0.3071.86 or later.
Which versions of Google Chrome are affected by CVE-2017-5078?
CVE-2017-5078 affects Google Chrome versions prior to 59.0.3071.86.
What platforms are impacted by CVE-2017-5078?
CVE-2017-5078 impacts Google Chrome running on Linux, Windows, and Mac.
Can CVE-2017-5078 be exploited remotely?
Yes, CVE-2017-5078 allows remote attackers to exploit the vulnerability through crafted HTML pages.