8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.037 Low
EPSS
Percentile
91.7%
Severity: Critical
Date : 2017-10-19
CVE-ID : CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15389
CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393
CVE-2017-15394 CVE-2017-15395 CVE-2017-5124 CVE-2017-5125
CVE-2017-5126 CVE-2017-5127 CVE-2017-5128 CVE-2017-5129
CVE-2017-5130 CVE-2017-5131 CVE-2017-5132 CVE-2017-5133
Package : chromium
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-456
The package chromium before version 62.0.3202.62-1 is vulnerable to
multiple issues including arbitrary code execution, cross-site
scripting, access restriction bypass, content spoofing, information
disclosure and denial of service.
Upgrade to 62.0.3202.62-1.
The problems have been fixed upstream in version 62.0.3202.62.
None.
A UI spoofing issue has been found in the Blink component of the
Chromium browser < 62.0.3202.62.
A content security bypass has been found in the Chromium browser <
62.0.3202.62.
An out-of-bounds read has been found in the Skia component of the
Chromium browser < 62.0.3202.62.
A URL spoofing issue has been found in the Omnibox component of the
Chromium browser < 62.0.3202.62.
A URL spoofing issue has been found in the Omnibox component of the
Chromium browser < 62.0.3202.62.
An extension limitation bypass has been found in the Extensions
component of the Chromium browser < 62.0.3202.62.
An incorrect registry key handling issue has been found in the
PlatformIntegration component of the Chromium browser < 62.0.3202.62.
A referrer leak has been found in the Devtools component of the
Chromium browser < 62.0.3202.62.
A URL spoofing flaw has been found in the extensions UI of the Chromium
browser < 62.0.3202.62.
A null-pointer dereference flaw has been found in the ImageCapture
component of the Chromium browser < 62.0.3202.62.
A universal XSS flaw has been found in the MHTML component of the
Chromium browser < 62.0.3202.62.
A heap overflow security issue has been found in the Skia component of
the Chromium browser < 62.0.3202.62.
A use-after-free security issue has been found in the PDFium component
of the Chromium browser < 62.0.3202.62.
A use-after-free security issue has been found in the PDFium component
of the Chromium browser < 62.0.3202.62.
A heap overflow security issue has been found in the WebGL component of
the Chromium browser < 62.0.3202.62.
A use-after-free security issue has been found in the WebAudio
component of the Chromium browser < 62.0.3202.62.
A heap overflow security issue has been found in libxml2.
An out-of-bounds write has been found in the Skia component of the
Chromium browser < 62.0.3202.62.
An incorrect stack manipulation security issue has been found in the
WebAssembly component of the Chromium browser < 62.0.3202.62.
An out-of-bounds write has been found in the Skia component of the
Chromium browser < 62.0.3202.62.
A remote attacker can bypass security measures, trick the user by
spoofing parts of the UI, cause a denial of service or execute
arbitrary code on the affected host.
https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html
https://crbug.com/752003
https://crbug.com/756040
https://crbug.com/756563
https://crbug.com/739621
https://crbug.com/750239
https://crbug.com/598265
https://crbug.com/714401
https://crbug.com/732751
https://crbug.com/745580
https://crbug.com/759457
https://crbug.com/762930
https://crbug.com/749147
https://crbug.com/760455
https://crbug.com/765384
https://crbug.com/765469
https://crbug.com/765495
https://crbug.com/722079
https://crbug.com/744109
https://crbug.com/718858
https://crbug.com/762106
https://security.archlinux.org/CVE-2017-15386
https://security.archlinux.org/CVE-2017-15387
https://security.archlinux.org/CVE-2017-15388
https://security.archlinux.org/CVE-2017-15389
https://security.archlinux.org/CVE-2017-15390
https://security.archlinux.org/CVE-2017-15391
https://security.archlinux.org/CVE-2017-15392
https://security.archlinux.org/CVE-2017-15393
https://security.archlinux.org/CVE-2017-15394
https://security.archlinux.org/CVE-2017-15395
https://security.archlinux.org/CVE-2017-5124
https://security.archlinux.org/CVE-2017-5125
https://security.archlinux.org/CVE-2017-5126
https://security.archlinux.org/CVE-2017-5127
https://security.archlinux.org/CVE-2017-5128
https://security.archlinux.org/CVE-2017-5129
https://security.archlinux.org/CVE-2017-5130
https://security.archlinux.org/CVE-2017-5131
https://security.archlinux.org/CVE-2017-5132
https://security.archlinux.org/CVE-2017-5133
chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html
crbug.com/598265
crbug.com/714401
crbug.com/718858
crbug.com/722079
crbug.com/732751
crbug.com/739621
crbug.com/744109
crbug.com/745580
crbug.com/749147
crbug.com/750239
crbug.com/752003
crbug.com/756040
crbug.com/756563
crbug.com/759457
crbug.com/760455
crbug.com/762106
crbug.com/762930
crbug.com/765384
crbug.com/765469
crbug.com/765495
security.archlinux.org/AVG-456
security.archlinux.org/CVE-2017-15386
security.archlinux.org/CVE-2017-15387
security.archlinux.org/CVE-2017-15388
security.archlinux.org/CVE-2017-15389
security.archlinux.org/CVE-2017-15390
security.archlinux.org/CVE-2017-15391
security.archlinux.org/CVE-2017-15392
security.archlinux.org/CVE-2017-15393
security.archlinux.org/CVE-2017-15394
security.archlinux.org/CVE-2017-15395
security.archlinux.org/CVE-2017-5124
security.archlinux.org/CVE-2017-5125
security.archlinux.org/CVE-2017-5126
security.archlinux.org/CVE-2017-5127
security.archlinux.org/CVE-2017-5128
security.archlinux.org/CVE-2017-5129
security.archlinux.org/CVE-2017-5130
security.archlinux.org/CVE-2017-5131
security.archlinux.org/CVE-2017-5132
security.archlinux.org/CVE-2017-5133
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.037 Low
EPSS
Percentile
91.7%