PT-2017-14066 · Google+4 · Google Chrome+4

Drew Springall

·

Publicado

2017-12-06

·

Atualizado

2024-06-15

·

CVE-2017-15420

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 63.0.3239.84 Google Chrome versions prior to 64.0.3282.119
Description The issue is related to incorrect handling of back navigations in error pages in browser navigation, allowing a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. This can be achieved by using a specially formed HTML page.
Recommendations For Google Chrome versions prior to 63.0.3239.84, update to version 63.0.3239.84 or later. For Google Chrome versions prior to 64.0.3282.119, update to version 64.0.3282.119 or later.

Exploit

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2017-2813
ALT-PU-2018-1126
CVE-2017-15420
DSA-4064-1
DSA-4103-1
OPENSUSE-SU-2017:3245-1
OPENSUSE-SU-2017_3244-1
OPENSUSE-SU-2018:0313-1
OPENSUSE-SU-2018_0259-1
OPENSUSE-SU-2024:10681-1
OPENSUSE-SU-2024:12948-1
RHSA-2017:3401
RHSA-2017_3401

Produtos afetados

Alt Linux
Google Chrome
Opera
Red Hat
Suse