CVE-2017-5066
medium
CVSS v3
6.5
CVSS v2
4.3
VIR risk
6.5
Description
Insufficient consistency checks in signature handling in the networking stack in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to incorrectly accept a badly formed X.509 certificate via a crafted HTML page.
Predictions
Exploit likelihood
75%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: arch — https://security.archlinux.org/ASA-201704-5
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| arch | fixed | 58.0.3029.81-1 | |
| rhel | 6.0 | affected | |
| linux-kernel | - | not-affected | |
| macos | - | not-affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| chrome | {"endExcluding":"58.0.3029.81"} | 58.0.3029.81 |
References
- https://security.archlinux.org/ASA-201704-5
- http://www.securityfocus.com/bid/97939
- http://www.securitytracker.com/id/1038317
- https://access.redhat.com/errata/RHSA-2017:1124
- https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html
- https://crbug.com/690821
- https://security.gentoo.org/glsa/201705-02
CWEs
CWE-347
Verify integrity in audit chain (admin only). AS-IS.