Use-after-free error in Google Chrome - CVE-2017-15412

Vulnerability identifier: #VU9577

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-15412

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in libXML. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

Google Chrome
Arch Linux
Amazon Linux AMI
Gentoo Linux
Debian Linux
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Ubuntu
Fedora
JBoss Application Server
System x Integrated Management Module (IMM2)
Flex System Integrated Management Module (IMM2)
Flex System Chassis Management Module (CMM)
Integrated Management Module II (IMM2) for BladeCenter Systems
Data Computing Appliance (DCA)
libxml2 (Red Hat package)
chromium
App Connect Enterprise Certified Container
IBM Flex System Fabric EN4093R 10Gb Scalable Switch
IBM Flex System EN2092 1Gb Ethernet Scalable Switch
IBM Flex System Fabric SI4093 GbFSIM 10Gb Scalable Switch
Flex System Fabric CN4093 10Gb ScSE firmware

Update to version 63.0.3239.84.

Google Chrome - update to 63.0.3239.84
System x Integrated Management Module (IMM2) - update to 1AOO84C-6.80
Flex System Integrated Management Module (IMM2) - update to 1AOO84C-6.80
Integrated Management Module II (IMM2) for BladeCenter Systems - update to 1AOO84C-6.80-bc
Flex System Chassis Management Module (CMM) - update to 2pet16c-2.5.12c
libxml2 (Red Hat package) - update to 2.9.1-6.el7.4
Data Computing Appliance (DCA) - update to 4.3.0.0
App Connect Enterprise Certified Container - addressed in versions 5.0.1, 6.1.0
IBM Flex System Fabric EN4093R 10Gb Scalable Switch - update to 7.8.20.00
IBM Flex System EN2092 1Gb Ethernet Scalable Switch - update to 7.8.20.00
IBM Flex System Fabric SI4093 GbFSIM 10Gb Scalable Switch - update to 7.8.20.00
Flex System Fabric CN4093 10Gb ScSE firmware - update to 7.8.20.00
chromium - addressed in versions 63.0.3239.108-1.fc26, 63.0.3239.108-1.fc27

• Exploit #2287 - Exploits (Containing Self Made Perl Reproducers / PoC Codes) (April 7, 2020)
• Exploit #1995 - Alien-Framework (Alien-Framework, it is a framework with many CVE exploits and tools to use in pen-testing.) (March 18, 2020)

• https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html?utm_source=feed...

• Multiple vulnerabilities in Google Chrome
• Arch Linux update for chromium
• Ubuntu update for libxml2
• Ubuntu update for libxml2
• Gentoo update for Chromium, Google Chrome
• Debian update for libxml2
• Remote code execution in Red Hat JBoss
• OpenSUSE Linux update for chromium
• OpenSUSE Linux update for chromium
• Red Hat update for chromium-browser
• Amazon Linux AMI update for libxml2
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Red Hat Enterprise Linux 7 update for libxml2
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
• Multiple vulnerabilities in IBM Flex System switch firmware products
• Fedora 27 update for chromium
• Fedora 26 update for chromium
• Multiple vulnerabilities in IBM Integrated Management Module II (IMM2)