PT-2017-14066 · Google+4 · Google Chrome+4

Drew Springall · Published 2017-12-06 · Updated 2024-06-15 · CVE-2017-15420

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 63.0.3239.84 Google Chrome versions prior to 64.0.3282.119

Description The issue is related to incorrect handling of back navigations in error pages in browser navigation, allowing a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. This can be achieved by using a specially formed HTML page.

Recommendations For Google Chrome versions prior to 63.0.3239.84, update to version 63.0.3239.84 or later. For Google Chrome versions prior to 64.0.3282.119, update to version 64.0.3282.119 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2017-2813

ALT-PU-2018-1126

CVE-2017-15420

DSA-4064-1

DSA-4103-1

OPENSUSE-SU-2017:3245-1

OPENSUSE-SU-2017_3244-1

OPENSUSE-SU-2018:0313-1

OPENSUSE-SU-2018_0259-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

RHSA-2017:3401

RHSA-2017_3401

Affected Products

Alt Linux

Google Chrome

Opera

Red Hat

Suse

References · 2340

• 🔥 https://crbug.com/777419 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-15420 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2018:0313-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4103-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15420 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-15420 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-15420 · Security Note
• https://debian.org/security/2018/dsa-4103 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:3245-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3401 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10681-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4064-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15420 · Vendor Advisory
• https://security.gentoo.org/glsa/201801-03 · Vendor Advisory