DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Google Chrome: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2017-10-18
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Chrome ausnutzen, um Informationen einzusehen, Sicherheitsmechanismen zu umgehen, Daten zu manipulieren, einen Denial of Service herbeizuführen oder Code mit den Privilegien des Angegriffenen zur Ausführung zu bringen.
01
beschreibt (20)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2017-5133US | high8.8 | — | ||
Off-by-one read/write on the heap in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to corrupt memory and possibly leak information and potentially execute… | ||||
| CVE-2017-5132US | high8.8 | — | ||
Inappropriate implementation in V8 in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka incorrect We… | ||||
| CVE-2017-5131US | high8.8 | — | ||
An integer overflow in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka an out-of-bounds wr… | ||||
| CVE-2017-5130US | high8.8 | — | ||
An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap… | ||||
| CVE-2017-5129US | high8.8 | — | ||
A use after free in WebAudio in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. | ||||
| CVE-2017-5128US | high8.8 | — | ||
Heap buffer overflow in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, related to WebGL. | ||||
| CVE-2017-5127US | high8.8 | — | ||
Use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. | ||||
| CVE-2017-5126US | high8.8 | — | ||
A use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. | ||||
| CVE-2017-5125US | high8.8 | — | ||
Heap buffer overflow in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||||
| CVE-2017-5124US | medium6.1 | Exploit | ||
Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted MHTML page. | ||||
| CVE-2017-15395US | medium6.5 | — | ||
A use after free in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka an ImageCapture NULL… | ||||
| CVE-2017-15394US | medium6.5 | Exploit | ||
Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing in permission dialogs via IDN homographs i… | ||||
| CVE-2017-15393US | high8.8 | — | ||
Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via… | ||||
| CVE-2017-15392US | medium4.3 | — | ||
Insufficient data validation in V8 in Google Chrome prior to 62.0.3202.62 allowed an attacker who can write to the Windows Registry to potentially exploit heap corruption via a cra… | ||||
| CVE-2017-15391US | medium6.5OT erhöht | — | ||
Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to access Extension pages without authorisation via a crafted HTML pa… | ||||
| CVE-2017-15390US | medium6.5 | — | ||
Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. | ||||
| CVE-2017-15389US | medium6.5 | — | ||
An insufficient watchdog timer in navigation in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page… | ||||
| CVE-2017-15388US | high8.8 | — | ||
Iteration through non-finite points in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. | ||||
| CVE-2017-15387US | high8.8 | — | ||
Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javascript: URL windows when they should not b… | ||||
| CVE-2017-15386US | medium6.5 | — | ||
Incorrect implementation in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2017:2997 vom 2017-10-20external
- Chrome Releases Stable Channel Update for Desktop vom 2017-10-18external
- WID-SEC-W-2025-1427 - CSAF Versionself
- WID-SEC-2025-1427 - Portal Versionself
- Debian Security Advisory DSA-4020 vom 2017-11-07external
- Dell Security Advisory DSA-2025-269 vom 2025-07-01external
- SUSE Security Update SUSE-SU-2018:0395-1 vom 2018-02-08external
- SUSE Security Update SUSE-SU-2018:0401-1 vom 2018-02-09external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan