PT-2017-3233 · Opera+4 · Opera+5
S0Rrymybad
·
Publicado
2017-06-05
·
Atualizado
2025-02-20
·
CVE-2017-5070
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 59.0.3071.86 for Linux, Windows, and Mac
Google Chrome version prior to 59.0.3071.92 for Android
Opera versions prior to 59.0.3071.86
Description
The issue is related to a type confusion in the V8 JavaScript engine, which can be exploited by a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This can be achieved by specially forming an HTML page.
Recommendations
For Google Chrome versions prior to 59.0.3071.86 for Linux, Windows, and Mac, update to version 59.0.3071.86 or later.
For Google Chrome version prior to 59.0.3071.92 for Android, update to version 59.0.3071.92 or later.
For Opera versions prior to 59.0.3071.86, update to version 59.0.3071.86 or later.
As a temporary workaround, consider restricting access to crafted HTML pages until a patch is available.
Exploit
Correção
Incorrect Type Conversion or Cast
Type Confusion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Google Chrome
Opera
Red Hat
Suse
V8 Javascript Engine