CVE-2019-5860: free in PDFium
Use after free in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.87 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What does exploitation require?
The issue is triggered through a crafted PDF file and requires user interaction. The advisory states that a remote attacker could potentially exploit resulting heap corruption.
Which installations can be identified as affected from the available version information?
Google Chrome versions earlier than 76.0.3809.87 are affected. Debian Chromium is listed as affected software, but no Debian package version information is provided.
What impact is indicated by the CVSS vector?
The CVSS vector rates availability impact as high, with no confidentiality or integrity impact specified. It also identifies the attack complexity as low and requires user interaction.