CVE-2017-5076
medium
CVSS v3
6.5
CVSS v2
4.3
VIR risk
6.5
Description
Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
Predictions
Exploit likelihood
75%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: arch — https://security.archlinux.org/ASA-201706-8
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| arch | fixed | 59.0.3071.86-1 | |
| rhel | 6.0 | affected | |
| macos | - | not-affected | |
| linux-kernel | - | not-affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| chrome | {"endExcluding":"59.0.3071.86"} | 59.0.3071.86 |
References
- https://security.archlinux.org/ASA-201706-8
- http://www.securityfocus.com/bid/98861
- http://www.securitytracker.com/id/1038622
- https://access.redhat.com/errata/RHSA-2017:1399
- https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html
- https://crbug.com/719199
- https://security.gentoo.org/glsa/201706-20
CWEs
CWE-20
Verify integrity in audit chain (admin only). AS-IS.