Security bypass in Google Chrome - CVE-2017-5087

Vulnerability identifier: #VU7125

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-5087

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to an error in IndexedDB. A remote attacker can escape the sandbox and gain access to the system.

Successful exploitation of the vulnerability results in security bypass.

Google Chrome
Arch Linux
Debian Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Fedora
chromium

Update to version 59.0.3071.104.

Google Chrome - update to 59.0.3071.104
chromium - addressed in versions 59.0.3071.104-1.el7, 59.0.3071.104-1.fc24, 59.0.3071.104-1.fc25, 59.0.3071.104-1.fc26

• https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html

• Multiple vulnerabilities in Google Chrome
• Arch Linux update for chromium
• Debian update for chromium-browser
• Red Hat update for chromium-browser
• Fedora 26 update for chromium
• Fedora 24 update for chromium
• Fedora 25 update for chromium
• Fedora EPEL 7 update for chromium