CVE-2019-5842: Use After Free
Published Jun 13, 2019
·Updated
Use after free in Blink in Google Chrome prior to 75.0.3770.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Software
3 affected componentsFixes available
Google Chrome<75.0.3770.90
75.0.3770.90
Google Chrome<75.0.3770.90
debian/chromium
150.0.7871.100-1~deb12u1156.0.8078.73-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.73-1~deb13u1156.0.8078.47-1156.0.8078.79-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 75.0.3770.90 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Jun 13, 2019
CVE Published
12:00 AM
Nov 25, 2019
CVE Published
via MITRE·02:22 PM
Data Sourced
via MITRE·02:22 PM
DescriptionWeakness
Frequently Asked Questions
1
What user interaction is required for exploitation?
An attacker must cause the victim to interact with a crafted HTML page. The attacker does not need prior privileges on the target system.
2
Which browsers should be checked for exposure?
Google Chrome versions earlier than 75.0.3770.90 are affected. Debian Chromium is also listed as affected, but no specific Debian package version is provided.