SB2017070406 - Arch Linux update for qt5-webengine
Published: July 4, 2017 Updated: June 14, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Type confusion (CVE-ID: CVE-2017-5070)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion flaw in the V8 component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion condition and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
2) Out-of-bounds read (CVE-ID: CVE-2017-5071)
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due to out of bounds read flaw in the V8 component of the Chromium browser. A remote attacker can read arbitrary files on the system.
Successful exploitation of the vulnerability results in information disclosure.
3) Memory leak (CVE-ID: CVE-2017-5075)
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due to memory leak flaw in the CSP reporting component of the Chromium browser. A remote attacker can read arbitrary files on the system.
Successful exploitation of the vulnerability results in information disclosure.
4) Spoofing attack (CVE-ID: CVE-2017-5076)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an address spoofing flaw in the Omnibox component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct URL spoofing attacks.
Successful exploitation of the vulnerability results in content spoofing.
5) Heap-based buffer overflow (CVE-ID: CVE-2017-5077)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to heap-based buffer overflow in the Skia component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
6) Command injection (CVE-ID: CVE-2017-5078)
The vulnerability allows a remote attacker to execute arbitrary command on the target system.
The vulnerability exists due to command injection flaw in the mailto handling component. A remote attacker can create a specially crafted web page containing malicious commands, trick the victim into visiting it and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
7) Spoofing attack (CVE-ID: CVE-2017-5079)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to UI spoofing flaw has been found in the Blink component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct spoofing attacks.
Successful exploitation of the vulnerability results in content spoofing.
8) Spoofing attack (CVE-ID: CVE-2017-5083)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to UI spoofing flaw has been found in the Blink component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct spoofing attacks.
Successful exploitation of the vulnerability results in content spoofing.
9) Information disclosure (CVE-ID: CVE-2017-5088)
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.The weakness exists due to out-of-bounds read error in V8. A remote attacker can read arbitrary files that may allow to conduct further attacks.
Successful exploitation of the vulnerability results in information disclosure.
10) Spoofing attack (CVE-ID: CVE-2017-5089)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an address spoofing flaw in the Omnibox component. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct domain spoofing attacks.
Successful exploitation of the vulnerability results in address spoofing.
Remediation
Install update from vendor's website.