PT-2017-1264 · Google+6 · Google Chrome+6

Published 2017-01-25 · Updated 2024-06-15 · CVE-2017-5025

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 56.0.2924.76 Opera versions prior to 56.0.2924.76

Description The issue is caused by a lack of proper bounds checking in the FFmpeg component, which can lead to heap corruption. A remote attacker can potentially exploit this by using a crafted video file, resulting in a denial of service.

Recommendations For Google Chrome versions prior to 56.0.2924.76, update to version 56.0.2924.76 or later. For Opera versions prior to 56.0.2924.76, update to version 56.0.2924.76 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2017-1150

BDU:2017-00378

CVE-2017-5025

DSA-3776-1

MGASA-2017-0111

MGASA-2018-0008

OPENSUSE-SU-2017:0565-1

OPENSUSE-SU-2017:1531-1

OPENSUSE-SU-2017_0499-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

RHSA-2017:0206

RHSA-2017_0206

USN-3180-1

Affected Products

Alt Linux

Ffmpeg

Google Chrome

Opera

Red Hat

Suse

Ubuntu

References · 2368

• https://osv.dev/vulnerability/ALPINE-CVE-2017-5025 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5009 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5023 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3180-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5010 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5017 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-5025 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-5025 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5025 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5025 · Security Note
• https://advisories.mageia.org/MGASA-2017-0111.html · Security Note
• http://rhn.redhat.com/errata/RHSA-2017-0206.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5007 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5019 · Vendor Advisory