Multiple vulnerabilities in Google Chrome
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 16 |
| CVE-ID | CVE-2017-5070 CVE-2017-5071 CVE-2017-5072 CVE-2017-5073 CVE-2017-5074 CVE-2017-5075 CVE-2017-5076 CVE-2017-5077 CVE-2017-5078 CVE-2017-5079 CVE-2017-5080 CVE-2017-5081 CVE-2017-5082 CVE-2017-5083 CVE-2017-5085 CVE-2017-5086 |
| CWE-ID | CWE-843 CWE-125 CWE-264 CWE-416 CWE-401 CWE-122 CWE-77 CWE-200 |
| Exploitation vector | Network |
| Public exploit | Vulnerability #1 is being exploited in the wild. |
| Vulnerable software Subscribe |
Google Chrome Client/Desktop applications / Web browsers |
| Vendor |
Security Bulletin
This security bulletin contains information about 16 vulnerabilities.
1) Type confusion
EUVDB-ID: #VU6956
Risk: High
CVSSv3.1: 9.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]
CVE-ID: CVE-2017-5070
CWE-ID:
CWE-843 - Type confusion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion flaw in the V8 component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion condition and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationUpdate to version 59.0.3071.86.
Vulnerable software versionsGoogle Chrome: 55.0.2883.75 - 58.0.3029.110
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
http://security.archlinux.org/advisory/ASA-201706-8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
2) Out-of-bounds read
EUVDB-ID: #VU6957
Risk: Low
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5071
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due to out of bounds read flaw in the V8 component of the Chromium browser. A remote attacker can read arbitrary files on the system.
Successful exploitation of the vulnerability results in information disclosure.
Update to version 59.0.3071.86.
Vulnerable software versionsGoogle Chrome: 55.0.2883.75 - 58.0.3029.110
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
http://security.archlinux.org/advisory/ASA-201706-8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Spoofing attack
EUVDB-ID: #VU6958
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5072
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an address spoofing flaw in the Omnibox component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct URL spoofing attacks.
Successful exploitation of the vulnerability results in content spoofing.
Update to version 59.0.3071.86.
Vulnerable software versionsGoogle Chrome: 55.0.2883.75 - 58.0.3029.110
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
http://security.archlinux.org/advisory/ASA-201706-8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Use-after-free error
EUVDB-ID: #VU6959
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5073
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to use-after-free error in the print preview component. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationUpdate to version 59.0.3071.86.
Vulnerable software versionsGoogle Chrome: 55.0.2883.75 - 58.0.3029.110
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
http://security.archlinux.org/advisory/ASA-201706-8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Use-after-free error
EUVDB-ID: #VU6960
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5074
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to use-after-free error in the Apps Bluetooth component. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationUpdate to version 59.0.3071.86.
Vulnerable software versionsGoogle Chrome: 55.0.2883.75 - 58.0.3029.110
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
http://security.archlinux.org/advisory/ASA-201706-8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Memory leak
EUVDB-ID: #VU6961
Risk: Low
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5075
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due to memory leak flaw in the CSP reporting component of the Chromium browser. A remote attacker can read arbitrary files on the system.
Successful exploitation of the vulnerability results in information disclosure.
MitigationUpdate to version 59.0.3071.86.
Vulnerable software versionsGoogle Chrome: 55.0.2883.75 - 58.0.3029.110
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
http://security.archlinux.org/advisory/ASA-201706-8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Spoofing attack
EUVDB-ID: #VU6962
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5076
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an address spoofing flaw in the Omnibox component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct URL spoofing attacks.
Successful exploitation of the vulnerability results in content spoofing.
Update to version 59.0.3071.86.
Vulnerable software versionsGoogle Chrome: 55.0.2883.75 - 58.0.3029.110
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
http://security.archlinux.org/advisory/ASA-201706-8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Heap-based buffer overflow
EUVDB-ID: #VU6963
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5077
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to heap-based buffer overflow in the Skia component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationUpdate to version 59.0.3071.86.
Vulnerable software versionsGoogle Chrome: 55.0.2883.75 - 58.0.3029.110
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
http://security.archlinux.org/advisory/ASA-201706-8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Command injection
EUVDB-ID: #VU6964
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5078
CWE-ID:
CWE-77 - Command injection
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary command on the target system.
The vulnerability exists due to command injection flaw in the mailto handling component. A remote attacker can create a specially crafted web page containing malicious commands, trick the victim into visiting it and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationUpdate to version 59.0.3071.86.
Vulnerable software versionsGoogle Chrome: 55.0.2883.75 - 58.0.3029.110
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
http://security.archlinux.org/advisory/ASA-201706-8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Spoofing attack
EUVDB-ID: #VU6965
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5079
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to UI spoofing flaw has been found in the Blink component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct spoofing attacks.
Successful exploitation of the vulnerability results in content spoofing.
MitigationUpdate to version 59.0.3071.86.
Vulnerable software versionsGoogle Chrome: 55.0.2883.75 - 58.0.3029.110
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
http://security.archlinux.org/advisory/ASA-201706-8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Use-after-free error
EUVDB-ID: #VU6966
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5080
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to use-after-free error in the credit card autofill component. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationUpdate to version 59.0.3071.86.
Vulnerable software versionsGoogle Chrome: 55.0.2883.75 - 58.0.3029.110
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
http://security.archlinux.org/advisory/ASA-201706-8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Authentication bypass
EUVDB-ID: #VU6967
Risk: Low
CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5081
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authentication on the target system.
The vulnerability exists due to extension verification bypass in the Chromium browser. A remote attacker can use a specially crafted file to bypass authentication and gain unauthorized access to the system.
Update to version 59.0.3071.86.
Vulnerable software versionsGoogle Chrome: 55.0.2883.75 - 58.0.3029.110
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
http://security.archlinux.org/advisory/ASA-201706-8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
13) Information disclosure
EUVDB-ID: #VU6968
Risk: Low
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5082
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information.
The weakness exists due to insufficient hardening flaw in the credit card editor component of the Chromium browser. A remote attacker can gain access to credentials.
Update to version 59.0.3071.86.
Vulnerable software versionsGoogle Chrome: 55.0.2883.75 - 58.0.3029.110
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
http://security.archlinux.org/advisory/ASA-201706-8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
14) Spoofing attack
EUVDB-ID: #VU6969
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5083
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to UI spoofing flaw has been found in the Blink component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct spoofing attacks.
Successful exploitation of the vulnerability results in content spoofing.
MitigationUpdate to version 59.0.3071.86.
Vulnerable software versionsGoogle Chrome: 55.0.2883.75 - 58.0.3029.110
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
http://security.archlinux.org/advisory/ASA-201706-8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
15) Cross-site scripting
EUVDB-ID: #VU6970
Risk: Low
CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5085
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionVulnerability allows a remote attacker to perform XSS attacks.
The vulnerability exists due to inappropriate execution of javascript on WebUI pages. A remote attacker can trick the victim to follow a specially specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationUpdate to version 59.0.3071.86.
Vulnerable software versionsGoogle Chrome: 55.0.2883.75 - 58.0.3029.110
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
http://security.archlinux.org/advisory/ASA-201706-8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
16) Spoofing attack
EUVDB-ID: #VU6971
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5086
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an address spoofing flaw in the Omnibox component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct URL spoofing attacks.
Successful exploitation of the vulnerability results in content spoofing.
Update to version 59.0.3071.86.
Vulnerable software versionsGoogle Chrome: 55.0.2883.75 - 58.0.3029.110
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
http://security.archlinux.org/advisory/ASA-201706-8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
