PT-2017-3246 · Google+3 · Google Chrome+3

Published 2017-03-29 · Updated 2024-06-15 · CVE-2017-5056

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 57.0.2987.133 for Linux, Windows, and Mac Google Chrome version prior to 57.0.2987.132 for Android

Description A use after free in Blink allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. This issue can be exploited by a remote attacker using a specially crafted HTML page.

Recommendations For Google Chrome versions prior to 57.0.2987.133 on Linux, Windows, and Mac, update to version 57.0.2987.133 or later. For Google Chrome version prior to 57.0.2987.132 on Android, update to version 57.0.2987.132 or later. As a temporary workaround, consider restricting access to crafted HTML pages until a patch is available.

Fix

Use After Free

Out of bounds Read

Weakness Enumeration

CWE-416

CWE-125

Related Identifiers

BDU:2017-02680

CVE-2017-5056

MGASA-2017-0111

OPENSUSE-SU-2017:0908-1

OPENSUSE-SU-2017:0909-1

OPENSUSE-SU-2017_0909-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

RHSA-2017:0860

RHSA-2017_0860

Affected Products

Google Chrome

Opera

Red Hat

Suse

References · 2336

• https://security.gentoo.org/glsa/201704-02 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5056 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5056 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0111.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10681-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:0908-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:0909-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5056 · Security Note
• https://ubuntu.com/security/CVE-2017-5056 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5056 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0111 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:0860 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02680 · Security Note
• https://suse.com/security/cve/CVE-2021-21192 · Note