CVE-2017-5121

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-5121
Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.debian.org/security/2017/dsa-3985
http://www.securityfocus.com/bid/100947
http://www.securitytracker.com/id/1039497
https://access.redhat.com/errata/RHSA-2017:2792
https://blogs.technet.microsoft.com/mmpc/2017/10/18/browser-security-beyond-sandboxing/
https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html
https://crbug.com/765433
https://security.gentoo.org/glsa/201709-25
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
History

07 Nov 2023, 02:49

Type Values Removed Values Added
References (REDHAT) https://access.redhat.com/errata/RHSA-2017:2792 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2017:2792 -
References (MISC) https://crbug.com/765433 - Exploit, Issue Tracking, Patch, Vendor Advisory () https://crbug.com/765433 -
References (BID) http://www.securityfocus.com/bid/100947 - Broken Link () http://www.securityfocus.com/bid/100947 -
References (MISC) https://blogs.technet.microsoft.com/mmpc/2017/10/18/browser-security-beyond-sandboxing/ - Exploit, Third Party Advisory () https://blogs.technet.microsoft.com/mmpc/2017/10/18/browser-security-beyond-sandboxing/ -
References (DEBIAN) http://www.debian.org/security/2017/dsa-3985 - Third Party Advisory () http://www.debian.org/security/2017/dsa-3985 -
References (GENTOO) https://security.gentoo.org/glsa/201709-25 - Third Party Advisory () https://security.gentoo.org/glsa/201709-25 -
References (SECTRACK) http://www.securitytracker.com/id/1039497 - Broken Link () http://www.securitytracker.com/id/1039497 -
References (MISC) https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html - Release Notes, Third Party Advisory () https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html -

06 Apr 2022, 18:18

Type Values Removed Values Added
CPE cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
References (SECTRACK) http://www.securitytracker.com/id/1039497 - Third Party Advisory, VDB Entry (SECTRACK) http://www.securitytracker.com/id/1039497 - Broken Link
References (REDHAT) https://access.redhat.com/errata/RHSA-2017:2792 - (REDHAT) https://access.redhat.com/errata/RHSA-2017:2792 - Third Party Advisory
References (MISC) https://crbug.com/765433 - Permissions Required (MISC) https://crbug.com/765433 - Exploit, Issue Tracking, Patch, Vendor Advisory
References (MISC) https://blogs.technet.microsoft.com/mmpc/2017/10/18/browser-security-beyond-sandboxing/ - Exploit, Technical Description, Third Party Advisory, Vendor Advisory (MISC) https://blogs.technet.microsoft.com/mmpc/2017/10/18/browser-security-beyond-sandboxing/ - Exploit, Third Party Advisory
References (BID) http://www.securityfocus.com/bid/100947 - Third Party Advisory, VDB Entry (BID) http://www.securityfocus.com/bid/100947 - Broken Link
First Time Redhat enterprise Linux Server
Redhat enterprise Linux Workstation
Redhat enterprise Linux Desktop
Redhat

08 Sep 2021, 17:21

Type Values Removed Values Added
CPE cpe:2.3:o:apple:mac_os:-:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
Information

Published : 2017-10-27 05:29

Updated : 2023-12-10 12:15

NVD link : CVE-2017-5121

Mitre link : CVE-2017-5121

CVE.ORG link : CVE-2017-5121

JSON object : View

Products Affected

google

  • chrome

redhat

  • enterprise_linux_workstation
  • enterprise_linux_desktop
  • enterprise_linux_server

microsoft

  • windows

linux

  • linux_kernel

apple

  • macos

debian

  • debian_linux
CWE
CWE-20

Improper Input Validation