CVE-2019-5846: Medium severity Google Chrome vulnerability
Published Jan 3, 2020
·Updated
Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Software
4 affected componentsFixes available
Google Chrome<73.0.3683.75
openSUSE Backports SLE=15.0-sp1
openSUSE Leap=15.1
debian/chromium
150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1
Event History
Jan 3, 2020
CVE Published
via MITRE·10:35 PM
Data Sourced
via MITRE·10:35 PM
DescriptionWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker needs to convince a user to load a crafted HTML page. The attack can be performed remotely and does not require prior authentication or privileges.
2
What security impact is identified?
The issue can potentially cause heap corruption through an out-of-bounds access in SwiftShader. The listed impact is high availability impact, with no listed confidentiality or integrity impact.
3
Which Chrome versions are affected?
Google Chrome versions prior to 73.0.3683.75 are affected.