CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
89.6%
Severity: Critical
Date : 2017-07-27
CVE-ID : CVE-2017-5091 CVE-2017-5092 CVE-2017-5093 CVE-2017-5094
CVE-2017-5095 CVE-2017-5097 CVE-2017-5098 CVE-2017-5099
CVE-2017-5100 CVE-2017-5101 CVE-2017-5102 CVE-2017-5103
CVE-2017-5104 CVE-2017-5105 CVE-2017-5106 CVE-2017-5107
CVE-2017-5108 CVE-2017-5109 CVE-2017-5110 CVE-2017-7000
Package : chromium
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-363
The package chromium before version 60.0.3112.78-1 is vulnerable to
multiple issues including arbitrary code execution, content spoofing
and information disclosure.
Upgrade to 60.0.3112.78-1.
The problems have been fixed upstream in version 60.0.3112.78.
None.
A use after free vulnerability has been found in the IndexedDB
component of the Chromium browser < 60.0.3112.78.
A use after free vulnerability has been found in the PPAPI component of
the Chromium browser < 60.0.3112.78.
A UI spoofing vulnerability has been found in the Blink component of
the Chromium browser < 60.0.3112.78.
A type confusion vulnerability has been found in the extensions
component of the Chromium browser < 60.0.3112.78.
An out-of-bounds write vulnerability has been found in the PDFium
component of the Chromium browser < 60.0.3112.78.
An out-of-bounds read vulnerability has been found in the Skia
component of the Chromium browser < 60.0.3112.78.
A use-after-free vulnerability has been found in the V8 component of
the Chromium browser < 60.0.3112.78.
An out-of-bounds write vulnerability has been found in the PPAPI
component of the Chromium browser < 60.0.3112.78.
A use-after-free vulnerability has been found in the Chrome Apps
component of the Chromium browser < 60.0.3112.78.
A URL spoofing vulnerability has been found in the Omnibox component of
the Chromium browser < 60.0.3112.78.
An uninitialized use vulnerability has been found in the Skia component
of the Chromium browser < 60.0.3112.78.
An uninitialized use vulnerability has been found in the Skia component
of the Chromium browser < 60.0.3112.78.
A UI spoofing vulnerability has been found in the Chromium browser <
60.0.3112.78.
A URL spoofing vulnerability has been found in the Omnibox component of
the Chromium browser < 60.0.3112.78.
A URL spoofing vulnerability using Cyrillic letters has been found in
the Omnibox component of the Chromium browser < 60.0.3112.78.
An information leakage vulnerability has been found in the Chromium
browser < 60.0.3112.78. By rendering a FeConvolveMatrix SVG filter over
a target iframe and timing its execution an attacking page can extract
pixel values from a cross-origin page being iframe’d. This also allows
reading ones own origin for history sniffing.
A type confusion vulnerability has been found in the PDFium component
of the Chromium browser < 60.0.3112.78.
A UI spoofing vulnerability has been found in the Chromium browser <
60.0.3112.78.
A UI spoofing vulnerability has been found in the payments dialog
component of the Chromium browser < 60.0.3112.78.
A pointer disclosure vulnerability has been found in SQLite, as used in
the Chromium browser < 60.0.3112.78.
A remote attacker can spoof the content displayed to the user, access
sensitive information and execute arbitrary code on the affected host.
https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
https://crbug.com/728887
https://crbug.com/733549
https://crbug.com/550017
https://crbug.com/702946
https://crbug.com/732661
https://crbug.com/740789
https://crbug.com/740803
https://crbug.com/733548
https://crbug.com/718292
https://crbug.com/681740
https://crbug.com/727678
https://crbug.com/726199
https://crbug.com/729105
https://crbug.com/729979
https://crbug.com/714628
https://crbug.com/686253
https://crbug.com/695830
https://crbug.com/710400
https://crbug.com/717476
https://crbug.com/742407
https://security.archlinux.org/CVE-2017-5091
https://security.archlinux.org/CVE-2017-5092
https://security.archlinux.org/CVE-2017-5093
https://security.archlinux.org/CVE-2017-5094
https://security.archlinux.org/CVE-2017-5095
https://security.archlinux.org/CVE-2017-5097
https://security.archlinux.org/CVE-2017-5098
https://security.archlinux.org/CVE-2017-5099
https://security.archlinux.org/CVE-2017-5100
https://security.archlinux.org/CVE-2017-5101
https://security.archlinux.org/CVE-2017-5102
https://security.archlinux.org/CVE-2017-5103
https://security.archlinux.org/CVE-2017-5104
https://security.archlinux.org/CVE-2017-5105
https://security.archlinux.org/CVE-2017-5106
https://security.archlinux.org/CVE-2017-5107
https://security.archlinux.org/CVE-2017-5108
https://security.archlinux.org/CVE-2017-5109
https://security.archlinux.org/CVE-2017-5110
https://security.archlinux.org/CVE-2017-7000
chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
crbug.com/550017
crbug.com/681740
crbug.com/686253
crbug.com/695830
crbug.com/702946
crbug.com/710400
crbug.com/714628
crbug.com/717476
crbug.com/718292
crbug.com/726199
crbug.com/727678
crbug.com/728887
crbug.com/729105
crbug.com/729979
crbug.com/732661
crbug.com/733548
crbug.com/733549
crbug.com/740789
crbug.com/740803
crbug.com/742407
security.archlinux.org/AVG-363
security.archlinux.org/CVE-2017-5091
security.archlinux.org/CVE-2017-5092
security.archlinux.org/CVE-2017-5093
security.archlinux.org/CVE-2017-5094
security.archlinux.org/CVE-2017-5095
security.archlinux.org/CVE-2017-5097
security.archlinux.org/CVE-2017-5098
security.archlinux.org/CVE-2017-5099
security.archlinux.org/CVE-2017-5100
security.archlinux.org/CVE-2017-5101
security.archlinux.org/CVE-2017-5102
security.archlinux.org/CVE-2017-5103
security.archlinux.org/CVE-2017-5104
security.archlinux.org/CVE-2017-5105
security.archlinux.org/CVE-2017-5106
security.archlinux.org/CVE-2017-5107
security.archlinux.org/CVE-2017-5108
security.archlinux.org/CVE-2017-5109
security.archlinux.org/CVE-2017-5110
security.archlinux.org/CVE-2017-7000
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
89.6%