SB2017060703 - Multiple vulnerabilities in Google Chrome
Published: June 7, 2017 Updated: June 14, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 16 secuirty vulnerabilities.
1) Type confusion (CVE-ID: CVE-2017-5070)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion flaw in the V8 component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion condition and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
2) Out-of-bounds read (CVE-ID: CVE-2017-5071)
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due to out of bounds read flaw in the V8 component of the Chromium browser. A remote attacker can read arbitrary files on the system.
Successful exploitation of the vulnerability results in information disclosure.
3) Spoofing attack (CVE-ID: CVE-2017-5072)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an address spoofing flaw in the Omnibox component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct URL spoofing attacks.
Successful exploitation of the vulnerability results in content spoofing.
4) Use-after-free error (CVE-ID: CVE-2017-5073)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to use-after-free error in the print preview component. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
5) Use-after-free error (CVE-ID: CVE-2017-5074)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to use-after-free error in the Apps Bluetooth component. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
6) Memory leak (CVE-ID: CVE-2017-5075)
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due to memory leak flaw in the CSP reporting component of the Chromium browser. A remote attacker can read arbitrary files on the system.
Successful exploitation of the vulnerability results in information disclosure.
7) Spoofing attack (CVE-ID: CVE-2017-5076)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an address spoofing flaw in the Omnibox component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct URL spoofing attacks.
Successful exploitation of the vulnerability results in content spoofing.
8) Heap-based buffer overflow (CVE-ID: CVE-2017-5077)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to heap-based buffer overflow in the Skia component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
9) Command injection (CVE-ID: CVE-2017-5078)
The vulnerability allows a remote attacker to execute arbitrary command on the target system.
The vulnerability exists due to command injection flaw in the mailto handling component. A remote attacker can create a specially crafted web page containing malicious commands, trick the victim into visiting it and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
10) Spoofing attack (CVE-ID: CVE-2017-5079)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to UI spoofing flaw has been found in the Blink component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct spoofing attacks.
Successful exploitation of the vulnerability results in content spoofing.
11) Use-after-free error (CVE-ID: CVE-2017-5080)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to use-after-free error in the credit card autofill component. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
12) Authentication bypass (CVE-ID: CVE-2017-5081)
The vulnerability allows a remote attacker to bypass authentication on the target system.
The vulnerability exists due to extension verification bypass in the Chromium browser. A remote attacker can use a specially crafted file to bypass authentication and gain unauthorized access to the system.
13) Information disclosure (CVE-ID: CVE-2017-5082)
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The weakness exists due to insufficient hardening flaw in the credit card editor component of the Chromium browser. A remote attacker can gain access to credentials.
14) Spoofing attack (CVE-ID: CVE-2017-5083)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to UI spoofing flaw has been found in the Blink component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct spoofing attacks.
Successful exploitation of the vulnerability results in content spoofing.
15) Cross-site scripting (CVE-ID: CVE-2017-5085)
Vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability exists due to inappropriate execution of javascript on WebUI pages. A remote attacker can trick the victim to follow a specially specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
16) Spoofing attack (CVE-ID: CVE-2017-5086)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an address spoofing flaw in the Omnibox component of the Chromium browser. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct URL spoofing attacks.
Successful exploitation of the vulnerability results in content spoofing.
Remediation
Install update from vendor's website.