PT-2017-3181 · Google+3 · Google Chrome+4

Published 2017-03-16 · Updated 2024-06-15 · CVE-2017-5053

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 57.0.2987.133 for Linux, Windows, and Mac Google Chrome version prior to 57.0.2987.132 for Android

Description The issue is related to an out-of-bounds read in V8, which allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This is connected to the Array.prototype.indexOf method.

Recommendations For Google Chrome versions prior to 57.0.2987.133 for Linux, Windows, and Mac, update to version 57.0.2987.133 or later. For Google Chrome version prior to 57.0.2987.132 for Android, update to version 57.0.2987.132 or later. As a temporary workaround, consider restricting the use of the Array.prototype.indexOf method until a patch is available.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

CWE-264

Related Identifiers

BDU:2017-02601

CVE-2017-5053

MGASA-2017-0111

OPENSUSE-SU-2017:0908-1

OPENSUSE-SU-2017:0909-1

OPENSUSE-SU-2017_0909-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

RHSA-2017:0860

RHSA-2017_0860

ZDI-17-462

Affected Products

Google Chrome

Opera

Red Hat

Suse

V8

References · 2339

• 🔥 https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2017-5053.md · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:0860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5053 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-462 · Security Note
• https://bdu.fstec.ru/vul/2017-02601 · Security Note
• https://ubuntu.com/security/CVE-2017-5053 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5053 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5053 · Vendor Advisory
• https://security.gentoo.org/glsa/201704-02 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:0908-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10681-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0111 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0111.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5053 · Vendor Advisory