CVE-2019-5867: bounds read in V8
Out of bounds read in JavaScript in Google Chrome prior to 76.0.3809.100 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.100 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to persuade a user to load a crafted HTML page. The CVSS vector indicates exploitation is network-accessible, requires no privileges, and requires user interaction.
What is the likely impact of successful exploitation?
Successful exploitation could allow heap corruption, resulting in a high availability impact. The provided CVSS data does not indicate a direct confidentiality or integrity impact.
Which Chrome versions are affected?
Google Chrome versions prior to 76.0.3809.100 are affected. The listed software also includes Debian Chromium, but no affected Debian package version is provided.