Integer overflow in Google Chrome - CVE-2017-15422

Vulnerability identifier: #VU9588

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-15422

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to integer overflow in ICU. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Google Chrome
Arch Linux
Gentoo Linux
Debian Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Fedora
openSUSE Leap
qt5-qtwebengine
icu
chromium
Flex System Chassis Management Module (CMM)

Update to version 63.0.3239.84.

Google Chrome - update to 63.0.3239.84
Flex System Chassis Management Module (CMM) - update to 2pet16d-2.5.13d
qt5-qtwebengine - addressed in versions 5.10.1-1.fc26, 5.10.1-1.fc27
icu - update to 57.1-10.fc27
chromium - addressed in versions 63.0.3239.108-1.fc26, 63.0.3239.108-1.fc27

• https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html?utm_source=feed...

• Multiple vulnerabilities in Google Chrome
• Arch Linux update for chromium
• Gentoo update for Chromium, Google Chrome
• OpenSUSE Linux update for chromium
• OpenSUSE Linux update for chromium
• Debian update for icu
• OpenSUSE Linux update for icu
• Red Hat update for chromium-browser
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
• Fedora 27 update for chromium
• Fedora 26 update for chromium
• Fedora 27 update for qt5-qtwebengine
• Fedora 26 update for qt5-qtwebengine
• Fedora 27 update for icu