Kaspersky ID:
KLA11000
Дата обнаружения:
19/04/2017
Обновлено:
22/01/2024

Описание

Multiple serious vulnerabilities have been found in Google Chrome earlier than 58.0.3029.81. Malicious users can exploit these vulnerabilities to execute arbitrary code and spoof user interface.

Below is a complete list of vulnerabilities:

  1. Type confusion in the PDFium component can be exploited remotely by an unauthenticated attacker to cause denial of service;
  2. A use after free in the PrintPreview component can be exploited remotely by an unauthenticated attacker to cause denial of service;
  3. Type confusion in the Blink component can be exploited remotely by an unauthenticated attacker to execute arbitrary code;
  4. Insufficient Policy Enforcement in Omnibox component can be exploited remotely by an unauthenticated attacker to bypass security restrictions;
  5. A race condition in navigation can be exploited remotely by an unauthenticated attacker to spoof user interface;
  6. A use after free in Chrome Apps can be exploited remotely by an unauthenticated attacker to cause denial of service;
  7. A numeric overflow in the Skia component can be exploited remotely by an unauthenticated attacker to cause denial of service;
  8. Incorrect handling of DOM changes in Blink component can be exploited remotely by an unauthenticated attacker to cause denial of service;
  9. Lack of an appropriate action on page navigation in Blink component can be exploited remotely by an unauthenticated attacker to bypass security restrictions;
  10. Insufficient consistency checks in signature handling in the networking stack can be exploited remotely by an unauthenticated attacker to bypass security restrictions;
  11. An insufficient watchdog timer in navigation can be exploited remotely by an unauthenticated attacker to spoof user interface;
  12. Incorrect MIME type of XSS-Protection reports in Blink component can be exploited remotely by an unauthenticated attacker to escalate of privilege;

Technical details

NB: This vulnerability does not have any public CVSS rating, so rating can be changed by the time.

Первичный источник обнаружения

Связанные продукты

Список CVE

  • CVE-2017-5057
    high
  • CVE-2017-5058
    high
  • CVE-2017-5059
    high
  • CVE-2017-5060
    warning
  • CVE-2017-5061
    warning
  • CVE-2017-5062
    high
  • CVE-2017-5063
    high
  • CVE-2017-5064
    high
  • CVE-2017-5065
    warning
  • CVE-2017-5066
    warning
  • CVE-2017-5067
    warning
  • CVE-2017-5068
    high
  • CVE-2017-5069
    warning

Смотрите также

Узнай статистику распространения уязвимостей в своем регионе statistics.securelist.com

Нашли неточность в описании этой уязвимости? Дайте нам знать!
Узнай больше об угрозах и векторах атаки на Энциклопедии Kaspersky
Бесплатно
Читать
Kaspersky Premium
Комплексное решение для защиты вашей цифровой жизни
Премиум
Скачать
Confirm changes?
Your message has been sent successfully.