PT-2017-1267 · Google+4 · Google Chrome+4

Published 2017-01-25 · Updated 2024-06-15 · CVE-2017-5020

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android

Description The issue is caused by the lack of requirement for a user gesture for powerful download operations. This allows a remote attacker who convinces a user to install a malicious extension to execute arbitrary code via a crafted HTML page. The exploitation of this issue can enable remote attackers to install malicious extensions and execute arbitrary code using a specially crafted HTML page.

Recommendations For Google Chrome versions prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, update to version 56.0.2924.76 or later for Linux, Windows and Mac, and 56.0.2924.87 or later for Android to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability for Opera.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2017-1150

BDU:2017-00381

CVE-2017-5020

DSA-3776-1

MGASA-2017-0111

OPENSUSE-SU-2017:0565-1

OPENSUSE-SU-2017_0499-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

RHSA-2017:0206

RHSA-2017_0206

Affected Products

Alt Linux

Google Chrome

Opera

Red Hat

Suse

References · 2336

• https://nvd.nist.gov/vuln/detail/CVE-2017-5020 · Security Note
• https://ubuntu.com/security/CVE-2017-5020 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0111.html · Security Note
• http://rhn.redhat.com/errata/RHSA-2017-0206.html · Vendor Advisory
• https://security.gentoo.org/glsa/201701-66 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10681-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3776-1 · Vendor Advisory
• http://debian.org/security/2017/dsa-3776 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00381 · Security Note
• https://osv.dev/vulnerability/MGASA-2017-0111 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:0565-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5020 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5020 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5020 · Vendor Advisory