CVE-2019-5855: Integer overflow in PDFium
Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.87 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker would need to get a user to open or otherwise process a crafted PDF file in an affected Chrome version. The CVSS vector indicates network reachability, low attack complexity, no required privileges, and required user interaction.
What is the potential impact?
A crafted PDF can trigger an integer overflow in PDFium and potentially cause heap corruption. The supplied CVSS assessment rates availability impact as high, with no confidentiality or integrity impact listed.
Which deployments should be prioritized for remediation?
Google Chrome versions prior to 76.0.3809.87 are identified as affected. The listed software also includes debian/chromium, but the provided data does not specify affected Debian package versions.