Vulnerability Details : CVE-2017-5118
Potential exploit
Blink in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, failed to correctly propagate CSP restrictions to javascript scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page.
Products affected by CVE-2017-5118
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-5118
0.61%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 68 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-5118
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
4.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
2.8
|
1.4
|
NIST |
CWE ids for CVE-2017-5118
-
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-5118
-
http://www.debian.org/security/2017/dsa-3985
Debian -- Security Information -- DSA-3985-1 chromium-browserThird Party Advisory
-
https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html
Chrome Releases: Stable Channel Update for DesktopRelease Notes;Third Party Advisory
-
http://www.securityfocus.com/bid/100610
Google Chrome Prior to 61.0.3163.79 Multiple Security VulnerabilitiesBroken Link
-
http://www.securitytracker.com/id/1039291
Google Chrome Multiple Flaws Let Remote Bypass Security Restrictions and Execute Arbitrary Code - SecurityTrackerBroken Link
-
https://crbug.com/747847
747847 - Security: CSP not inherited after navigation to JavaScript scheme uri - chromium - MonorailExploit;Issue Tracking;Patch;Vendor Advisory
-
https://security.gentoo.org/glsa/201709-15
Chromium: Multiple vulnerabilities (GLSA 201709-15) — Gentoo securityThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2017:2676
RHSA-2017:2676 - Security Advisory - Red Hat Customer PortalThird Party Advisory
Jump to