Vulnerability Details : CVE-2019-5756

Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.

Vulnerability category: Execute code

Published 2019-02-19 17:29:00

Updated 2019-04-17 17:20:33

Source Google Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2019-5756

Probability of exploitation activity in the next 30 days: 1.41%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 85 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2019-5756

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	[email protected]
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9	[email protected]
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-5756

CWE-416 Use After Free

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Assigned by: [email protected] (Primary)

References for CVE-2019-5756

https://www.debian.org/security/2019/dsa-4395

Third Party Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/106767

Third Party Advisory;VDB Entry

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/[email protected]/message/JVFHYCJGMZQUKYSIE2BXE4NLEGFGUXU5/

Third Party Advisory

CVEs referencing this url
https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html

Vendor Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:0309

Third Party Advisory

CVEs referencing this url
https://crbug.com/895152

Exploit;Issue Tracking;Vendor Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/ZQOP53LXXPRGD4N5OBKGQTSMFXT32LF6/

Mailing List;Release Notes;Third Party Advisory

CVEs referencing this url

Products affected by CVE-2019-5756

Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Desktop » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Workstation » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
Matching versions
Google » Chrome
Versions before (<) 72.0.3626.81
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 29
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 30
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Matching versions