URL spoofing in Google Chrome - CVE-2017-5067

Vulnerability identifier: #VU6367

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-5067

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to spoof URLs.

The vulnerability exists due to an error in Omnibox. A remote attacker can spoof URLs.

Google Chrome
Arch Linux
Fedora
Gentoo www-client/chromium
chromium-native_client
chromium

Update to version 58.0.3029.81.

Google Chrome - update to 58.0.3029.81
chromium-native_client - addressed in versions 58.0.3029.81-1.20170421gitc948e9b.fc25, 58.0.3029.81-1.20170421gitc948e9b.fc26
chromium - addressed in versions 58.0.3029.110-2.el7, 58.0.3029.110-2.fc25, 58.0.3029.110-2.fc26

• https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html

• Multiple vulnerabilities in Google Chrome
• Gentoo update for Chromium
• Arch Linux update for chromium
• OpenSUSE Linux update for chromium
• OpenSUSE Linux update for chromium
• Fedora 25 update for chromium, chromium-native_client
• Fedora 26 update for chromium, chromium-native_client
• Fedora EPEL 7 update for chromium