CVE-2019-5845: Medium severity Google Chrome vulnerability
Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker would need to induce a user to load a crafted HTML page. The vulnerability is remotely reachable and does not require attacker privileges, but user interaction is required.
Which Chrome versions are affected?
Google Chrome versions prior to 73.0.3683.75 are affected. The listed affected software also includes openSUSE Backports SLE, openSUSE Leap, and Debian Chromium.
What is the likely impact of successful exploitation?
Successful exploitation could cause heap corruption through an out-of-bounds access in SwiftShader, potentially resulting in denial of service. The provided severity vector indicates no stated confidentiality or integrity impact, with high availability impact.