PT-2017-3234 · Google+3 · Google Chrome+3

Published 2017-04-19 · Updated 2024-06-15 · CVE-2017-5069

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 58.0.3029.81 for Linux, Windows, and Mac Google Chrome version prior to 58.0.3029.83 for Android

Description The issue allows a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page, due to an incorrect MIME type of XSS-Protection reports in Blink. This can be exploited by a remote attacker using a specially formed HTML page to bypass CORS checks.

Recommendations For Google Chrome versions prior to 58.0.3029.81 on Linux, Windows, and Mac, update to version 58.0.3029.81 or later. For Google Chrome version prior to 58.0.3029.83 on Android, update to version 58.0.3029.83 or later. As a temporary workaround, consider restricting access to the X-XSS-Protection header to minimize the risk of exploitation.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-20

CWE-79

Related Identifiers

BDU:2017-02668

CVE-2017-5069

MGASA-2017-0317

OPENSUSE-SU-2017:1098-1

OPENSUSE-SU-2017:1100-1

OPENSUSE-SU-2017_1098-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

RHSA-2017:1124

RHSA-2017_1124

Affected Products

Google Chrome

Opera

Red Hat

Suse

References · 2341

• 🔥 https://crbug.com/691726 · Exploit
• https://cve.org/CVERecord?id=CVE-2017-5069 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5069 · Vendor Advisory
• https://security.gentoo.org/glsa/201705-02 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5069 · Security Note
• https://access.redhat.com/errata/RHSA-2017:1124 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0317 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:1098-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02668 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2017:1100-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10681-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5069 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0317.html · Security Note
• https://ubuntu.com/security/CVE-2017-5069 · Vendor Advisory