Risk | High |
Patch available | YES |
Number of vulnerabilities | 23 |
CVE-ID | CVE-2017-5087 CVE-2017-5088 CVE-2017-5089 CVE-2017-5091 CVE-2017-5092 CVE-2017-5093 CVE-2017-5094 CVE-2017-5095 CVE-2017-5097 CVE-2017-5098 CVE-2017-5099 CVE-2017-5100 CVE-2017-5101 CVE-2017-5102 CVE-2017-5103 CVE-2017-5104 CVE-2017-5105 CVE-2017-5106 CVE-2017-5107 CVE-2017-5108 CVE-2017-5109 CVE-2017-5110 CVE-2017-7000 |
CWE-ID | CWE-264 CWE-125 CWE-416 CWE-843 CWE-787 CWE-665 CWE-401 CWE-200 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Debian Linux Operating systems & Components / Operating system |
Vendor | Debian |
Security Bulletin
This security bulletin contains information about 23 vulnerabilities.
EUVDB-ID: #VU7125
Risk: Low
CVSSv3.1: 7.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5087
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass security restrictions on the target system.
The weakness exists due to an error in IndexedDB. A remote attacker can escape the sandbox and gain access to the system.
Successful exploitation of the vulnerability results in security bypass.
Update the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7126
Risk: Low
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5088
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to out-of-bounds read error in V8. A remote attacker can read arbitrary files that may allow to conduct further attacks.
Successful exploitation of the vulnerability results in information disclosure.
Update the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7127
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5089
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an address spoofing flaw in the Omnibox component. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct domain spoofing attacks.
Successful exploitation of the vulnerability results in address spoofing.
MitigationUpdate the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7618
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5091
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to use-after free error in IndexedDB. A remote attacker can trick the victim into visiting a specially crafted web page, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Update the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7619
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5092
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to use-after free error in PPAPI. A remote attacker can trick the victim into visiting a specially crafted web page, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Update the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7620
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5093
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to UI spoofing in Blink. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct domain spoofing attacks.
Successful exploitation of the vulnerability results in address spoofing.
MitigationUpdate the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7621
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5094
CWE-ID:
CWE-843 - Type confusion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to type confusion in extensions. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Update the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7622
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5095
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to out-of-bounds write in PDFium. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Update the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7624
Risk: Low
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5097
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information on the system.
The weakness exists due to out-of-bounds read in Skia. A remote attacker can trick the victim into visiting a specially crafted web page and read important files on the system.
Successful exploitation of the vulnerability results in information disclosure.
Update the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7625
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5098
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to use-after free error in V8. A remote attacker can trick the victim into visiting a specially crafted web page, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Update the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7626
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5099
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to out-of-bounds write in PPAPI. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Update the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7627
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5100
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to use-after free error in Chrome Apps. A remote attacker can trick the victim into visiting a specially crafted web page, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Update the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7628
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5101
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to URL spoofing in OmniBox. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct domain spoofing attacks.
Successful exploitation of the vulnerability results in address spoofing.
MitigationUpdate the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7629
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5102
CWE-ID:
CWE-665 - Improper Initialization
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass security restrictions.
The weakness exists due to uninitialized use in Skia. A remote attacker can trick the victim into visiting a specially crafted web page and gain access to the system.
Update the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7630
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5103
CWE-ID:
CWE-665 - Improper Initialization
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass security restrictions.
The weakness exists due to uninitialized use in Skia. A remote attacker can trick the victim into visiting a specially crafted web page and gain access to the system.
Update the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7631
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5104
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to UI spoofing in browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct domain spoofing attacks.
Successful exploitation of the vulnerability results in address spoofing.
MitigationUpdate the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7632
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5105
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to URL spoofing in OmniBox. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct domain spoofing attacks.
Successful exploitation of the vulnerability results in address spoofing.
MitigationUpdate the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7635
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5106
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to URL spoofing in OmniBox. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct domain spoofing attacks.
Successful exploitation of the vulnerability results in address spoofing.
MitigationUpdate the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7636
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5107
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information on the system.
The weakness exists due to memory leak via SVG. A remote attacker can trick the victim into visiting a specially crafted web page and read arbitrary files on the system.
Successful exploitation of the vulnerability results in information disclosure.
Update the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7637
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5108
CWE-ID:
CWE-843 - Type confusion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information on the system.
The weakness exists due to type confusion in PDFium. A remote attacker can trick the victim into visiting a specially crafted web page and read arbitrary files on the system.
Successful exploitation of the vulnerability results in information disclosure.
Update the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7633
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5109
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to UI spoofing in browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct domain spoofing attacks.
Successful exploitation of the vulnerability results in address spoofing.
MitigationUpdate the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7634
Risk: Low
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-5110
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to UI spoofing in payments dialog. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct domain spoofing attacks.
Successful exploitation of the vulnerability results in address spoofing.
MitigationUpdate the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7638
Risk: Low
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-7000
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information on the system.
The weakness exists due to pointer disclosure in SQLite. A remote attacker can trick the victim into visiting a specially crafted web page and read arbitrary files on the system.
Successful exploitation of the vulnerability results in information disclosure.
Update the affected package to version: 60.0.3112.78-1~deb9u1, 60.0.3112.78-1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.