PT-2016-3225 · Google+3 · Google Chrome+3

Published 2016-11-07 · Updated 2024-06-15 · CVE-2017-5052

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 57.0.2987.133 for Mac, Windows, and Linux Google Chrome version prior to 57.0.2987.132 for Android

Description The issue is caused by an incorrect assumption about block structure in Blink, allowing a remote attacker to potentially exploit memory corruption via a crafted HTML page. This could lead to security restrictions being bypassed, confidential information being obtained, arbitrary code execution with elevated privileges, or a denial of service. The exploitation is triggered by improper casting.

Recommendations For Google Chrome versions prior to 57.0.2987.133 for Mac, Windows, and Linux, update to version 57.0.2987.133 or later. For Google Chrome version prior to 57.0.2987.132 for Android, update to version 57.0.2987.132 or later.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2017-02602

CVE-2017-5052

MGASA-2017-0111

OPENSUSE-SU-2017:0908-1

OPENSUSE-SU-2017:0909-1

OPENSUSE-SU-2017_0909-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

RHSA-2017:0860

RHSA-2017_0860

Affected Products

Google Chrome

Opera

Red Hat

Suse

References · 2335

• 🔥 https://crbug.com/662767 · Exploit
• https://bdu.fstec.ru/vul/2017-02602 · Security Note
• https://security.gentoo.org/glsa/201704-02 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5052 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5052 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5052 · Security Note
• https://advisories.mageia.org/MGASA-2017-0111.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10681-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:0908-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5052 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:0909-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0111 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:0860 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5052 · Vendor Advisory