PT-2017-1262 · Opera+2 · Opera+2

Published 2017-01-25 · Updated 2019-10-03 · CVE-2017-5027

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 56.0.2924.76 for Linux, Windows and Mac Google Chrome version prior to 56.0.2924.87 for Android Opera (affected versions not specified)

Description The issue is related to the Blink component in Google Chrome, which failed to properly enforce the unsafe-inline content security policy. This allowed a remote attacker to bypass the content security policy via a crafted HTML page. The exploitation of this issue can enable a remote attacker to circumvent the content security policy using a specially formed HTML page.

Recommendations For Google Chrome versions prior to 56.0.2924.76 on Linux, Windows, and Mac, update to version 56.0.2924.76 or later. For Google Chrome version prior to 56.0.2924.87 on Android, update to version 56.0.2924.87 or later. For Opera, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2017-1150

BDU:2017-00376

CVE-2017-5027

DSA-3776-1

MGASA-2017-0111

Affected Products

Alt Linux

Google Chrome

Opera

References · 16

• https://osv.dev/vulnerability/MGASA-2017-0111 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3776-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5027 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5027 · Security Note
• https://ubuntu.com/security/CVE-2017-5027 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00376 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5027 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0111.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-5027 · Security Note
• https://crbug.com/661126 · Note
• https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html · Note
• https://chromereleases.googleblog.com/2017/02/stable-channel-update-for-desktop.html · Note
• https://bugs.mageia.org/show_bug.cgi?id=20187 · Note
• https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html · Note
• https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_16.html · Note