Vulnerability Details : CVE-2017-5121
Potential exploit
Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.
Vulnerability category: Input validationExecute code
Products affected by CVE-2017-5121
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-5121
9.41%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 92 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-5121
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2017-5121
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-5121
-
https://access.redhat.com/errata/RHSA-2017:2792
RHSA-2017:2792 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.debian.org/security/2017/dsa-3985
Debian -- Security Information -- DSA-3985-1 chromium-browserThird Party Advisory
-
https://security.gentoo.org/glsa/201709-25
Chromium: Multiple vulnerabilities (GLSA 201709-25) — Gentoo securityThird Party Advisory
-
https://crbug.com/765433
765433 - Security: V8 JIT escape analysis bug - chromium - MonorailExploit;Issue Tracking;Patch;Vendor Advisory
-
https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html
Chrome Releases: Stable Channel Update for DesktopRelease Notes;Third Party Advisory
-
https://blogs.technet.microsoft.com/mmpc/2017/10/18/browser-security-beyond-sandboxing/
Browser security beyond sandboxing - Microsoft SecurityExploit;Third Party Advisory
-
http://www.securityfocus.com/bid/100947
Google Chrome V8 Multiple Out-of-Bounds Memory Access VulnerabilitiesBroken Link
-
http://www.securitytracker.com/id/1039497
Google Chrome Out-of-Bounds Access Errors Let Remote Users Execute Arbitrary Code on the Target System - SecurityTrackerBroken Link
Jump to