CVE-2017-5060
medium
CVSS v3
6.5
CVSS v2
4.3
VIR risk
6.5
Description
Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
Predictions
Exploit likelihood
75%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: arch — https://security.archlinux.org/ASA-201704-5
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| arch | fixed | 58.0.3029.81-1 | |
| rhel | 6.0 | affected | |
| linux-kernel | - | not-affected | |
| macos | - | not-affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| chrome | {"endExcluding":"58.0.3029.81"} | 58.0.3029.81 |
References
- https://security.archlinux.org/ASA-201704-5
- http://www.securityfocus.com/bid/97939
- http://www.securitytracker.com/id/1038317
- https://access.redhat.com/errata/RHSA-2017:1124
- https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html
- https://crbug.com/683314
- https://security.gentoo.org/glsa/201705-02
CWEs
CWE-863
Verify integrity in audit chain (admin only). AS-IS.