CVE-2017-5070
High · 8.8 CISA KEVCVSS
8.8
EPSS
32.1%
Published
Oct 27, 2017
CISA due date
Jun 22, 2022
The record
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:5 | chromium-browser-stable | 0 | 60.0.3112.101-1.mga5 |
| Mageia:5 | libwebp | 0 | 0.4.3-1.1.mga5 |
| Mageia:6 | chromium-browser-stable | 0 | 60.0.3112.101-1.mga6 |
| Red Hat:rhel_extras:6 | chromium-browser | 0 | 0:59.0.3071.86-1.el6_9 |
| Red Hat:rhel_extras:6 | chromium-browser-debuginfo | 0 | 0:59.0.3071.86-1.el6_9 |
| SUSE:Package Hub 12 SP2 | chromium | 0 | 59.0.3071.86-20.1 |
| Ubuntu:14.04:LTS | chromium-browser | 0 | 59.0.3071.109-0ubuntu0.14.04.1186 |
| Ubuntu:16.04:LTS | chromium-browser | 0 | 59.0.3071.109-0ubuntu0.16.04.1289 |
| Ubuntu:16.04:LTS | libv8-3.14 | 0 | No fix |
| Ubuntu:16.04:LTS | oxide-qt | 0 | No fix |
| Ubuntu:18.04:LTS | libv8-3.14 | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | libv8-3.14 | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | oxide-qt | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | libv8-3.14 | 0 | No fix |
| openSUSE:Tumbleweed | chromium | 0 | 93.0.4577.82-1.1 |
| openSUSE:Tumbleweed | chromium | 0 | 113.0.5672.92-1.1 |
Related vulnerabilities
- CVE-2016-9651 A missing check for whether a property of a JS object is private in V8 in Google Chrome… Also affects chromium-browser-stable
- CVE-2017-5098 A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux… Also affects chromium-browser-stable
- CVE-2017-5029 The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in… Also affects chromium-browser-stable
- CVE-2017-5040 V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108… Also affects chromium-browser-stable
- CVE-2017-5030 Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for… Also affects chromium-browser-stable
- CVE-2017-5006 Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87… Also affects chromium-browser-stable
- CVE-2016-5198 V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and… Also affects chromium-browser-stable
- CVE-2016-5204 Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google… Also affects chromium-browser-stable