CVE-2017-5038

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-5038
Chrome Apps in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac had a use after free bug in GuestView, which allowed a remote attacker to perform an out of bounds memory read via a crafted Chrome extension.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://rhn.redhat.com/errata/RHSA-2017-0499.html
http://www.debian.org/security/2017/dsa-3810
http://www.securityfocus.com/bid/96767
https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html
https://crbug.com/695476
https://security.gentoo.org/glsa/201704-02
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
History

07 Nov 2023, 02:48

Type Values Removed Values Added
References (CONFIRM) https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html - Vendor Advisory () https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html -
References (CONFIRM) https://crbug.com/695476 - Issue Tracking, Patch, Permissions Required, Vendor Advisory () https://crbug.com/695476 -
References (BID) http://www.securityfocus.com/bid/96767 - Broken Link () http://www.securityfocus.com/bid/96767 -
References (DEBIAN) http://www.debian.org/security/2017/dsa-3810 - Third Party Advisory () http://www.debian.org/security/2017/dsa-3810 -
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2017-0499.html - Third Party Advisory () http://rhn.redhat.com/errata/RHSA-2017-0499.html -
References (GENTOO) https://security.gentoo.org/glsa/201704-02 - Third Party Advisory () https://security.gentoo.org/glsa/201704-02 -

22 Apr 2022, 20:28

Type Values Removed Values Added
References (DEBIAN) http://www.debian.org/security/2017/dsa-3810 - (DEBIAN) http://www.debian.org/security/2017/dsa-3810 - Third Party Advisory
References (CONFIRM) https://crbug.com/695476 - Issue Tracking, Patch (CONFIRM) https://crbug.com/695476 - Issue Tracking, Patch, Permissions Required, Vendor Advisory
References (GENTOO) https://security.gentoo.org/glsa/201704-02 - (GENTOO) https://security.gentoo.org/glsa/201704-02 - Third Party Advisory
References (BID) http://www.securityfocus.com/bid/96767 - Third Party Advisory, VDB Entry (BID) http://www.securityfocus.com/bid/96767 - Broken Link
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2017-0499.html - (REDHAT) http://rhn.redhat.com/errata/RHSA-2017-0499.html - Third Party Advisory
CPE cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
First Time Debian debian Linux
Redhat enterprise Linux Desktop
Redhat enterprise Linux Server
Debian
Redhat enterprise Linux Workstation
Redhat

08 Sep 2021, 17:19

Type Values Removed Values Added
CPE cpe:2.3:o:apple:mac_os:-:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
Information

Published : 2017-04-24 23:59

Updated : 2023-12-10 12:01

NVD link : CVE-2017-5038

Mitre link : CVE-2017-5038

CVE.ORG link : CVE-2017-5038

JSON object : View

Products Affected

redhat

  • enterprise_linux_desktop
  • enterprise_linux_server
  • enterprise_linux_workstation

apple

  • macos

google

  • chrome

linux

  • linux_kernel

microsoft

  • windows

debian

  • debian_linux
CWE
CWE-416

Use After Free