PT-2017-3233 · Opera+4 · Opera+5
S0Rrymybad
·
Published
2017-06-05
·
Updated
2025-02-20
·
CVE-2017-5070
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 59.0.3071.86 for Linux, Windows, and Mac
Google Chrome version prior to 59.0.3071.92 for Android
Opera versions prior to 59.0.3071.86
Description
The issue is related to a type confusion in the V8 JavaScript engine, which can be exploited by a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This can be achieved by specially forming an HTML page.
Recommendations
For Google Chrome versions prior to 59.0.3071.86 for Linux, Windows, and Mac, update to version 59.0.3071.86 or later.
For Google Chrome version prior to 59.0.3071.92 for Android, update to version 59.0.3071.92 or later.
For Opera versions prior to 59.0.3071.86, update to version 59.0.3071.86 or later.
As a temporary workaround, consider restricting access to crafted HTML pages until a patch is available.
Exploit
Fix
Incorrect Type Conversion or Cast
Type Confusion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Google Chrome
Opera
Red Hat
Suse
V8 Javascript Engine