Vulnerability Details : CVE-2017-5024
FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted video file.
Vulnerability category: Overflow
Products affected by CVE-2017-5024
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-5024
1.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 85 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-5024
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:N/A:P |
8.6
|
2.9
|
NIST | |
5.5
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2017-5024
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-5024
-
https://security.gentoo.org/glsa/201705-05
FFmpeg: Multiple vulnerabilities (GLSA 201705-05) — Gentoo security
-
http://www.debian.org/security/2017/dsa-3776
Debian -- Security Information -- DSA-3776-1 chromium-browser
-
http://www.securitytracker.com/id/1037718
Google Chrome Multiple Flaws Let Remote Users Access Files, Obtain Potentially Sensitive Information, Bypass Security, Spoof the User Interface, Conduct Cross-Site Scripting Attacks, and Execute Arbit
-
http://www.securityfocus.com/bid/95792
Google Chrome Multiple Security Vulnerabilities
-
http://rhn.redhat.com/errata/RHSA-2017-0206.html
RHSA-2017:0206 - Security Advisory - Red Hat Customer Portal
-
https://security.gentoo.org/glsa/201701-66
Chromium: Multiple vulnerabilities (GLSA 201701-66) — Gentoo security
-
https://crbug.com/643951
643951 - Security: FFMPEG MP4 Decoder chrome_child!mov_read_uuid heap allocation wrap - chromium - Monorail
-
https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html
Chrome Releases: Stable Channel Update for Desktop
Jump to