CVE-2017-15428
High · 8.8CVSS
8.8
EPSS
18.1%
Published
Jan 9, 2019
CISA due date
—
The record
Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in Google Chrome prior to 62.0.3202.94 and allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:9 | chromium-browser | 0 | 63.0.3239.84-1~deb9u1 |
| Ubuntu:16.04:LTS | chromium-browser | 0 | 74.0.3729.169-0ubuntu0.16.04.1 |
Related vulnerabilities
- CVE-2018-6156 Incorect derivation of a packet length in WebRTC in Google Chrome prior to 68.0.3440.75… Also affects chromium-browser
- CVE-2018-6126 A precision error in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote… Also affects chromium-browser
- CVE-2018-18356 An integer overflow in path handling lead to a use after free in Skia in Google Chrome… Also affects chromium-browser
- CVE-2018-17480 Execution of user supplied Javascript during array deserialization leading to an out of… Also affects chromium-browser
- CVE-2018-6065 Integer overflow in computing the required allocation size when instantiating a new… Also affects chromium-browser
- CVE-2018-17463 Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a… Also affects chromium-browser
- CVE-2017-5115 Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote… Also affects chromium-browser
- CVE-2017-5116 Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux… Also affects chromium-browser