CVE-2019-5868: free in PDFium ExecuteFieldAction
Use after free in PDFium in Google Chrome prior to 76.0.3809.100 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.100 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Frequently Asked Questions
What user interaction is required for exploitation?
The attacker needs a user to open or otherwise process a crafted PDF file in an affected Chrome installation. The CVSS vector indicates local attack access and required user interaction.
Which versions are affected?
Google Chrome versions prior to 76.0.3809.100 are affected according to the provided data. The listed software also includes Debian's chromium package, but no specific fixed Debian package version is provided.
What is the impact of a successful exploit?
A crafted PDF can trigger heap corruption through a use-after-free condition in PDFium. The supplied CVSS assessment rates availability impact as high, with no confidentiality or integrity impact listed.