CVE-2017-5046 : V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android had insufficient pol

V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android had insufficient policy enforcement, which allowed a remote attacker to spoof the location object via a crafted HTML page, related to Blink information disclosure.

Published 2017-04-24 23:59:01

Updated 2022-04-22 20:39:08

Source Google Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Exploit prediction scoring system (EPSS) score for CVE-2017-5046

Probability of exploitation activity in the next 30 days: 0.99%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 82 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2017-5046

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

References for CVE-2017-5046

https://crbug.com/680409

680409 - Security: Spoofing location object by overriding Symbol.toPrimitive - chromium - Monorail
Issue Tracking;Patch;Vendor Advisory
https://security.gentoo.org/glsa/201704-02

Chromium: Multiple vulnerabilities (GLSA 201704-02) — Gentoo security
Third Party Advisory

CVEs referencing this url
http://www.debian.org/security/2017/dsa-3810

Debian -- Security Information -- DSA-3810-1 chromium-browser
Third Party Advisory

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2017-0499.html

RHSA-2017:0499 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html

Chrome Releases: Stable Channel Update for Desktop
Vendor Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/96767

Google Chrome Prior to 57.0.2987.98 Multiple Security Vulnerabilities
Broken Link

CVEs referencing this url

Products affected by CVE-2017-5046

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Desktop » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Workstation » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
Matching versions
Google » Chrome
Versions up to, including, (<=) 57.0.2987.75
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Macos » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Google » Chrome
Versions up to, including, (<=) 57.0.2987.100
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Matching versions
When used together with: Google » Android » Version: N/A

Vulnerability Details : CVE-2017-5046

Exploit prediction scoring system (EPSS) score for CVE-2017-5046

CVSS scores for CVE-2017-5046

References for CVE-2017-5046

Products affected by CVE-2017-5046