5.4Medium
Google Chrome
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
8.8High
KEV
CVE-2017-5030Google Chromium V8 Memory Corruption Vulnerability
Known exploited — Google Chromium V8 Memory Corruption Vulnerability
CISA confirmed this vulnerability is used in real attacks on 08.06.2022. Remediation deadline for US federal agencies: 22.06.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2017-5030
Description
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Weakness (CWE):
CWE-125
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| debian | debian linux | 8.0 | |
| chrome | < 57.0.2987.98 | ||
| redhat | enterprise linux desktop | 6.0 | |
| redhat | enterprise linux server | 6.0 | |
| redhat | enterprise linux workstation | 6.0 | |
| — | Google Chrome prior to 57.0.2987.98 for Linux, Windows and Mac, and 57.0.2987.108 for Android | Google Chrome prior to 57.0.2987.98 for Linux, Windows and Mac, and 57.0.2987.108 for Android |
References and patches
- https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html Release NotesVendor Advisory
- GLSA-201704-02 vendor-advisoryThird Party Advisory
- https://crbug.com/682194 ExploitIssue Tracking
- DSA-3810 vendor-advisoryMailing ListThird Party Advisory
- 96767 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- RHSA-2017:0499 vendor-advisoryThird Party Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-20-126/ Third Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5030 US Government Resource
CPE matches (NVD) (7)
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*< 57.0.2987.98cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*< 57.0.2987.108cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*