PT-2017-16275 · Google+4 · Google Chrome+4

Published 2017-03-09 · Updated 2022-04-22 · CVE-2017-5038

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 57.0.2987.98

Description The issue is related to a use after free bug in GuestView, which allows a remote attacker to perform an out of bounds memory read via a crafted Chrome extension. This could potentially enable the attacker to read memory outside the intended boundaries.

Recommendations For versions prior to 57.0.2987.98, update to version 57.0.2987.98 or later to resolve the issue. As a temporary workaround, consider restricting the use of Chrome extensions to minimize the risk of exploitation.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2017-1391

CVE-2017-5038

DSA-3810-1

MGASA-2017-0111

OPENSUSE-SU-2017:0738-1

OPENSUSE-SU-2017:0740-1

OPENSUSE-SU-2017_0738-1

RHSA-2017:0499

RHSA-2017_0499

Affected Products

Alt Linux

Google Chrome

Opera

Red Hat

Suse

References · 42

• https://osv.dev/vulnerability/CVE-2017-5038 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5038 · Security Note
• http://rhn.redhat.com/errata/RHSA-2017-0499.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5038 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:0740-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5038 · Vendor Advisory
• https://security.gentoo.org/glsa/201704-02 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5038 · Security Note
• http://debian.org/security/2017/dsa-3810 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:0738-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0111.html · Security Note
• https://osv.dev/vulnerability/MGASA-2017-0111 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3810-1 · Vendor Advisory
• https://lists.opensuse.org/archives/list/[e-mail]/thread/2PWEOYPGN6NS2GPOOLH27ZPXQ7KSRFP4/#2PWEOYPGN6NS2GPOOLH27ZPXQ7KSRFP4 · Note
• https://suse.com/security/cve/CVE-2017-5040 · Note