CVE-2017-5040
Medium · 4.3CVSS
4.3
EPSS
23.8%
Published
Apr 24, 2017
CISA due date
—
The record
V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android was missing a neutering check, which allowed a remote attacker to read values in memory via a crafted HTML page.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:8 | chromium-browser | 0 | 57.0.2987.98-1~deb8u1 |
| Mageia:5 | chromium-browser-stable | 0 | 57.0.2987.133-1.mga5 |
| Red Hat:rhel_extras:6 | chromium-browser | 0 | 0:57.0.2987.98-1.el6 |
| Red Hat:rhel_extras:6 | chromium-browser-debuginfo | 0 | 0:57.0.2987.98-1.el6 |
| SUSE:Package Hub 12 SP2 | chromium | 0 | 57.0.2987.98-8.1 |
| Ubuntu:14.04:LTS | chromium-browser | 0 | 58.0.3029.81-0ubuntu0.14.04.1172 |
| Ubuntu:14.04:LTS | oxide-qt | 0 | 1.21.5-0ubuntu0.14.04.1 |
| Ubuntu:16.04:LTS | chromium-browser | 0 | 57.0.2987.98-0ubuntu0.16.04.1276 |
| Ubuntu:16.04:LTS | libv8-3.14 | 0 | No fix |
| Ubuntu:16.04:LTS | oxide-qt | 0 | 1.21.5-0ubuntu0.16.04.1 |
| Ubuntu:18.04:LTS | libv8-3.14 | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | libv8-3.14 | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | libv8-3.14 | 0 | No fix |
Related vulnerabilities
- CVE-2016-9651 A missing check for whether a property of a JS object is private in V8 in Google Chrome… Also affects chromium-browser
- CVE-2017-5029 The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in… Also affects chromium-browser
- CVE-2017-5030 Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for… Also affects chromium-browser
- CVE-2017-5006 Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87… Also affects chromium-browser
- CVE-2016-5198 V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and… Also affects chromium-browser
- CVE-2016-5204 Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google… Also affects chromium-browser
- CVE-2016-5170 WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google… Also affects chromium-browser
- CVE-2016-5141 Blink, as used in Google Chrome before 52.0.2743.116, allows remote attackers to spoof… Also affects chromium-browser