PT-2019-4595 · Google+5 · Skia+6

Published 2019-03-12 · Updated 2024-06-15 · CVE-2019-5798

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 73.0.3683.75

Description The issue is related to a lack of correct bounds checking in the Skia library of Google Chrome, allowing a remote attacker to perform an out of bounds memory read. This can be achieved via a crafted HTML page, potentially enabling the attacker to gain unauthorized access to information.

Recommendations For versions prior to 73.0.3683.75, update to version 73.0.3683.75 or later to resolve the issue.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2019-1529

BDU:2020-00687

CESA-2019_1265

CESA-2019_1267

CESA-2019_1269

CESA-2019_1308

CESA-2019_1309

CESA-2019_1310

CVE-2019-5798

DLA-1800-1

DLA-1806-1

DSA-4421-1

DSA-4448-1

DSA-4451-1

MGASA-2019-0190

MGASA-2019-0191

OPENSUSE-SU-2019:1062-1

OPENSUSE-SU-2019:1534-1

OPENSUSE-SU-2019:1664-1

OPENSUSE-SU-2019:1666-1

OPENSUSE-SU-2019_0343-1

OPENSUSE-SU-2019_1062-1

OPENSUSE-SU-2019_1484-1

OPENSUSE-SU-2019_1534-1

OPENSUSE-SU-2019_1666-1

OPENSUSE-SU-2024:10601-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

RHSA-2019:0708

RHSA-2019:1265

RHSA-2019:1267

RHSA-2019:1269

RHSA-2019:1308

RHSA-2019:1309

RHSA-2019:1310

RHSA-2019_0708

RHSA-2019_1265

RHSA-2019_1267

RHSA-2019_1269

RHSA-2019_1308

RHSA-2019_1309

RHSA-2019_1310

SUSE-SU-2019:1458-1

USN-3997-1

Affected Products

Alt Linux

Centos

Google Chrome

Red Hat

Skia

Suse

Ubuntu

References · 2767

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/chrome_filereader_uaf.rb · Exploit
• 🔥 https://github.com/exodusintel/CVE-2019-5786 · Exploit
• 🔥 https://crbug.com/883596 · Exploit
• https://osv.dev/vulnerability/MGASA-2019-0191 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0191.html · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2019-14 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9816 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1534-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9800 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9820 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11692 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3997-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1806-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html · Vendor Advisory