PT-2017-1061 · Google · Google Chrome

Phil Oester · Publicado 2017-01-19 · Atualizado 2017-01-20 · CVE-2016-5197

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 54.0.2840.85 for Android

Description The issue is related to insufficient validation of intent URLs in the content view client, allowing a remote attacker who has compromised the renderer process to start arbitrary activity on the system via a crafted HTML page. This could also enable a remote attacker to bypass certificate validation using a specially crafted HTML page.

Recommendations For Google Chrome versions prior to 54.0.2840.85 for Android, update to version 54.0.2840.85 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2017-00153

CVE-2016-5197

Produtos afetados

Google Chrome

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-5197 · Nota de Segurança
• https://crbug.com/659477 · Nota
• http://securityfocus.com/bid/94078 · Nota
• https://osv.dev/vulnerability/CVE-2016-5197 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-00153 · Nota de Segurança
• https://chromereleases.googleblog.com/2016/10/chrome-for-android-update_31.html · Nota