PT-2017-14044 · Opera+4 · Opera+5

Kushal Arvind Shah · Published 2017-10-17 · Updated 2024-06-15 · CVE-2017-15388

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 62.0.3202.62 Opera versions prior to 62.0.3202.62 (note: exact version not specified, assuming similar to Chrome)

Description The issue allows a remote attacker to perform an out of bounds memory read via a crafted HTML page. This is due to iteration through non-finite points in Skia.

Recommendations For Google Chrome versions prior to 62.0.3202.62, update to version 62.0.3202.62 or later. For Opera, since the exact fixed version is not specified, it is recommended to update to the latest version available, ensuring it is at or later than the equivalent Chrome fix. As a temporary workaround, consider restricting access to crafted HTML pages until a patch is available.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2017-2600

CVE-2017-15388

DSA-4020-1

MGASA-2017-0423

OPENSUSE-SU-2017:3245-1

OPENSUSE-SU-2017_2902-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

RHSA-2017:2997

RHSA-2017_2997

Affected Products

Alt Linux

Google Chrome

Opera

Red Hat

Skia

Suse

References · 2342

• 🔥 https://crbug.com/756563 · Exploit
• 🔥 https://bugs.chromium.org/p/chromium/issues/detail?id=756563 · Exploit
• https://security.gentoo.org/glsa/201710-24 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15388 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-15388 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15388 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-15388 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2017:3245-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10681-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0423 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15388 · Security Note
• https://access.redhat.com/errata/RHSA-2017:2997 · Vendor Advisory
• https://debian.org/security/2017/dsa-4020 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4020-1 · Vendor Advisory