CVE-2019-5847: Medium severity Google Chrome vulnerability
Inappropriate implementation in JavaScript in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 75.0.3770.142 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker would need to get a user to interact with a crafted HTML page. The vulnerability is remotely reachable and requires no attacker privileges, but user interaction is required.
What is the main security impact?
Successful exploitation could cause heap corruption and affect availability. The provided CVSS vector indicates no stated confidentiality or integrity impact, but a high availability impact.
Which versions should be remediated?
Google Chrome versions prior to 75.0.3770.142 are affected according to the available data. The listed software also includes Debian chromium, but no specific Debian package version is provided.