⚠ Actively exploited

Added to CISA KEV on 2022-06-08. Federal agencies required to patch by 2022-06-22. Required action: Apply updates per vendor instructions..

CVE-2017-5030 — Out-of-bounds Read in Google Chrome

CWE-125 — Out-of-bounds Read17 documents10 sources

Severity

8.8HIGHNVD

EPSS

50.7%

top 2.14%

CISA KEV

KEV

Added 2022-06-08

Due 2022-06-22

Exploit

Exploited in wild

Active exploitation observed

Affected products

Google Chrome Debian Linux Redhat Enterprise Linux Desktop +2 more

Timeline

PublishedApr 24

KEV addedJun 8

KEV dueJun 22

Latest updateDec 5

CISA Required Action: Apply updates per vendor instructions.

Description

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶NVDgoogle/chrome< 57.0.2987.98+1

▶NVDredhat/enterprise_linux_server6.0

▶NVDredhat/enterprise_linux_desktop6.0

▶NVDredhat/enterprise_linux_workstation6.0

Also affects: Debian Linux 8.0, 9.0

🔴Vulnerability Details

GHSA

GHSA-6w47-3vvr-m9hm: Incorrect handling of complex species in V8 in Google Chrome prior to 57↗2022-04-30

▶

OSV

oxide-qt vulnerabilities↗2017-03-29

▶

OSV

CVE-2017-5030: Incorrect handling of complex species in V8 in Google Chrome prior to 57↗2017-03-10

▶

VulnCheck

Google Chromium V8 Memory Corruption Vulnerability↗2017

▶

📋Vendor Advisories

CISA

Google Chromium V8 Memory Corruption Vulnerability↗2022-06-08

▶

Ubuntu

Oxide vulnerabilities↗2017-03-29

▶

Red Hat

chromium-browser: memory corruption in v8↗2017-03-09

▶