PT-2017-1274 · Google+5 · Google Chrome+5

Published 2017-01-25 · Updated 2024-06-15 · CVE-2017-5011

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 56.0.2924.76 Opera versions prior to 56.0.2924.76

Description The issue is related to insufficient sanitization of DevTools URLs, which allowed a remote attacker who convinced a user to install a malicious extension to read filesystem contents via a crafted HTML page. This could be achieved by exploiting the lack of protection for service data.

Recommendations For Google Chrome versions prior to 56.0.2924.76, update to version 56.0.2924.76 or later. For Opera versions prior to 56.0.2924.76, update to version 56.0.2924.76 or later. As a temporary workaround, consider disabling the installation of extensions until a patch is available. Restrict access to the DevTools module to minimize the risk of exploitation. Avoid using crafted HTML pages in the affected browser versions until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2017-1150

BDU:2017-00388

CVE-2017-5011

DSA-3776-1

MGASA-2017-0111

OPENSUSE-SU-2017:0565-1

OPENSUSE-SU-2017_0499-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

RHSA-2017:0206

RHSA-2017_0206

USN-3180-1

Affected Products

Alt Linux

Google Chrome

Opera

Red Hat

Suse

Ubuntu

References · 2352

• https://ubuntu.com/security/CVE-2017-5009 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5023 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3180-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5010 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5017 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5011 · Security Note
• https://advisories.mageia.org/MGASA-2017-0111.html · Security Note
• http://rhn.redhat.com/errata/RHSA-2017-0206.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5011 · Security Note
• https://ubuntu.com/security/CVE-2017-5007 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5019 · Vendor Advisory
• https://security.gentoo.org/glsa/201701-66 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10681-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5011 · Vendor Advisory