Integer overflow in Google Chrome - CVE-2019-5827

Vulnerability identifier: #VU23191

CSH Severity: High

CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-5827

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in SQLite component via WebSQL in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Google Chrome
Gentoo Linux
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Fedora
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Cloud Pak for Security (CP4S)
sqlite3 (Ubuntu package)
sqlite
sqlite (Red Hat package)
Red Hat OpenShift Serverless
OpenShift Virtualization
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Advanced Cluster Security for Kubernetes
Red Hat OpenStack

Install updates from vendor's website.

Google Chrome - update to 74.0.3729.131
Migration Toolkit for Containers - addressed in versions 1.5.4, 1.7.4
Cloud Pak for Security (CP4S) - update to 1.10.7.0
sqlite3 (Ubuntu package) - addressed in versions 3.11.0-1ubuntu1.3, 3.22.0-1ubuntu0.2, 3.27.2-2ubuntu0.2, 3.29.0-2ubuntu0.1
Red Hat OpenShift Serverless - update to 1.20.0
Red Hat Advanced Cluster Management for Kubernetes - update to 2.2.10
sqlite - addressed in versions 3.26.0-3.fc29, 3.26.0-5.fc30
sqlite (Red Hat package) - update to 3.26.0-15.el8
Red Hat Advanced Cluster Security for Kubernetes - update to 3.67
OpenShift Virtualization - update to 4.11.0
Red Hat OpenShift Container Platform - update to 4.11.0
Red Hat OpenStack - update to 16.2

• https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_30.html
• https://crbug.com/952406

• Ubuntu update for SQLite
• Gentoo update for SQLite
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC) 1.7
• Multiple vulnerabilities in OpenShift Virtualization
• Red Hat Enterprise Linux 8 update for sqlite
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 3.67
• Multiple vulnerabilities in Red Hat OpenShift Serverless 1.20
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Multiple vulnerabilities in Migration Toolkit for Containers 1.5
• Fedora 30 update for sqlite
• Fedora 29 update for sqlite
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.2