Out-of-bounds write in Google Chrome - CVE-2019-5831

Vulnerability identifier: #VU79648

CSH Severity: High

CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-5831

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error in map processing in V8 engine. A remote attacker can trick the victim to open a specially crafted website, trigger an out-of-bounds write and execute arbitrary code on the target system.

Google Chrome
Arch Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
chromium
chromium-browser (Red Hat package)
chromium-browser-debuginfo (Red Hat package)

Install updates from vendor's website.

Google Chrome - update to 75.0.3770.80
chromium - update to 75.0.3770.80-1
chromium-browser (Red Hat package) - update to 75.0.3770.80-1.el6_10
chromium-browser-debuginfo (Red Hat package) - update to 75.0.3770.80-1.el6_10

• https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html
• https://crbug.com/665766

• Multiple vulnerabilities in Google Chrome
• Arch Linux update for chromium
• Red Hat Enterprise Linux 6 Supplementary update for chromium-browser