CVE-2019-5843: High severity Google Chrome vulnerability
Out of bounds memory access in JavaScript in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to get a user to load a crafted HTML page. The CVSS vector indicates the attack can be delivered over the network without prior privileges, but requires user interaction.
What versions are affected?
Google Chrome versions prior to 74.0.3729.108 are affected. The listed software also includes Debian Chromium, but no affected or fixed Debian package version is provided here.
What is the likely impact of successful exploitation?
Successful exploitation may allow heap corruption. The supplied CVSS metrics rate confidentiality, integrity, and availability impact as high.