CVE-2017-5042

2017-04-2400:00:00

ubuntu.com

5.7 Medium

CVSS3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

3.3 Low

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

23.8%

JSON

Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and
57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which
allowed an attacker on the local network segment to initiate connections to
arbitrary URLs and observe any plaintext cookies sent.

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchchromium-browser< 58.0.3029.81-0ubuntu0.14.04.1172UNKNOWN
ubuntu16.04noarchchromium-browser< 57.0.2987.98-0ubuntu0.16.04.1276UNKNOWN
ubuntu16.10noarchchromium-browser< 57.0.2987.98-0ubuntu0.16.10.1344UNKNOWN
ubuntu17.04noarchchromium-browser< 57.0.2987.98-0ubuntu1.1348UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	chromium-browser	< 58.0.3029.81-0ubuntu0.14.04.1172	UNKNOWN
ubuntu	16.04	noarch	chromium-browser	< 57.0.2987.98-0ubuntu0.16.04.1276	UNKNOWN
ubuntu	16.10	noarch	chromium-browser	< 57.0.2987.98-0ubuntu0.16.10.1344	UNKNOWN
ubuntu	17.04	noarch	chromium-browser	< 57.0.2987.98-0ubuntu1.1348	UNKNOWN