CVE-2017-5373

What it actually does

Memory safety bugs leading to memory corruption that can be exploited to run arbitrary code.

Why it matters to the business

Potential remote code execution without authentication or user interaction on Chromium deployments across Debian and Ubuntu, enabling full system compromise, data theft, or ransomware deployment.

How an attack unfolds

An attacker serves malicious web content that triggers memory corruption during rendering, allowing control of the browser process to execute arbitrary code and potentially pivot within the environment.

How to fix it

Upgrade chromium packages to fixed versions chromium (Debian:11/12/13): 71.0.3578.80-1 and chromium-browser (Ubuntu:16.04:LTS): 71.0.3578.80-0ubuntu0.16.04.1.

How to confirm the fix worked

Confirm installed package versions match or exceed the listed fixed versions using the system package manager and verify no vulnerable instances remain in the environment.

Typical attack path

1. Serve malicious webpage or content to target browser
2. Trigger memory corruption via crafted input
3. Achieve arbitrary code execution within browser process
4. Establish persistence or perform further actions on host

How to detect it

Inspect browser process logs and crash reports for memory corruption indicators; monitor for unexpected outbound network connections originating from browser processes.

What your security team should do

• Apply the specified package upgrades immediately across all affected systems
• Prioritize patching given the high CVSS and potential for code execution
• Include browser updates in standard vulnerability management processes