CVE-2017-5030
High · 8.8 CISA KEVCVSS
8.8
EPSS
40.6%
Published
Apr 24, 2017
CISA due date
Jun 22, 2022
The record
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:8 | chromium-browser | 0 | 57.0.2987.98-1~deb8u1 |
| Mageia:5 | chromium-browser-stable | 0 | 57.0.2987.133-1.mga5 |
| Red Hat:rhel_extras:6 | chromium-browser | 0 | 0:57.0.2987.98-1.el6 |
| Red Hat:rhel_extras:6 | chromium-browser-debuginfo | 0 | 0:57.0.2987.98-1.el6 |
| SUSE:Package Hub 12 SP2 | chromium | 0 | 57.0.2987.98-8.1 |
| Ubuntu:14.04:LTS | chromium-browser | 0 | 58.0.3029.81-0ubuntu0.14.04.1172 |
| Ubuntu:14.04:LTS | oxide-qt | 0 | 1.21.5-0ubuntu0.14.04.1 |
| Ubuntu:16.04:LTS | chromium-browser | 0 | 57.0.2987.98-0ubuntu0.16.04.1276 |
| Ubuntu:16.04:LTS | libv8-3.14 | 0 | No fix |
| Ubuntu:16.04:LTS | oxide-qt | 0 | 1.21.5-0ubuntu0.16.04.1 |
| Ubuntu:18.04:LTS | libv8-3.14 | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | libv8-3.14 | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | libv8-3.14 | 0 | No fix |
| openSUSE:Tumbleweed | chromium | 0 | 93.0.4577.82-1.1 |
| openSUSE:Tumbleweed | chromium | 0 | 113.0.5672.92-1.1 |
Related vulnerabilities
- CVE-2016-9651 A missing check for whether a property of a JS object is private in V8 in Google Chrome… Also affects chromium-browser
- CVE-2017-5029 The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in… Also affects chromium-browser
- CVE-2017-5040 V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108… Also affects chromium-browser
- CVE-2017-5006 Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87… Also affects chromium-browser
- CVE-2016-5198 V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and… Also affects chromium-browser
- CVE-2016-5204 Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google… Also affects chromium-browser
- CVE-2016-5170 WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google… Also affects chromium-browser
- CVE-2016-5141 Blink, as used in Google Chrome before 52.0.2743.116, allows remote attackers to spoof… Also affects chromium-browser