Vulnerabilities > CVE-2017-15396 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
google
redhat
debian
icu-project
CWE-119
nessus
NVD
Published: 2018-08-28
Updated: 2023-11-07

Summary

A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Vulnerable Configurations

Part Description Count
Application
Google
3814
Application
Icu-Project
84
OS
Redhat
3
OS
Debian
3

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-9015553E3D.NASL
    descriptionAn update of QtWebEngine to the security and bugfix release 5.9.3, including : - Security fixes from Chromium up to version 62.0.3202.89. Including: CVE-2017-5124, CVE-2017-5126, CVE-2017-5127, CVE-2017-5128, CVE-2017-5129, CVE-2017-5132, CVE-2017-5133, CVE-2017-15386, CVE-2017-15387, CVE-2017-15388, CVE-2017-15390, CVE-2017-15392, CVE-2017-15394, CVE-2017-15396, CVE-2017-15398. - QtWebEngineCore: [QTBUG-64032] Fix crash after resizing view to be empty. - QtWebEngine[QML]: Fix loading some favicons including qt.io
    last seen2020-06-05
    modified2017-12-05
    plugin id105012
    published2017-12-05
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105012
    titleFedora 25 : qt5-qtwebengine (2017-9015553e3d)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory FEDORA-2017-9015553e3d.
#

include("compat.inc");

if (description)
{
  script_id(105012);
  script_version("3.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2017-15386", "CVE-2017-15387", "CVE-2017-15388", "CVE-2017-15390", "CVE-2017-15392", "CVE-2017-15394", "CVE-2017-15396", "CVE-2017-15398", "CVE-2017-5124", "CVE-2017-5126", "CVE-2017-5127", "CVE-2017-5128", "CVE-2017-5129", "CVE-2017-5132", "CVE-2017-5133");
  script_xref(name:"FEDORA", value:"2017-9015553e3d");

  script_name(english:"Fedora 25 : qt5-qtwebengine (2017-9015553e3d)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"An update of QtWebEngine to the security and bugfix release 5.9.3,
including :

  - Security fixes from Chromium up to version 62.0.3202.89.
    Including: CVE-2017-5124, CVE-2017-5126, CVE-2017-5127,
    CVE-2017-5128, CVE-2017-5129, CVE-2017-5132,
    CVE-2017-5133, CVE-2017-15386, CVE-2017-15387,
    CVE-2017-15388, CVE-2017-15390, CVE-2017-15392,
    CVE-2017-15394, CVE-2017-15396, CVE-2017-15398.

  - QtWebEngineCore: [QTBUG-64032] Fix crash after resizing
    view to be empty.

  - QtWebEngine[QML]: Fix loading some favicons including
    qt.io's

  - QtWebEngineWidgets: [QTBUG-62147] Fix crash on shutdown
    if a QWebEngineProfile was child of QApplication.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as
possible without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bodhi.fedoraproject.org/updates/FEDORA-2017-9015553e3d"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected qt5-qtwebengine package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:qt5-qtwebengine");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:25");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/02/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/12/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/12/05");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! preg(pattern:"^25([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 25", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);


flag = 0;
if (rpm_check(release:"FC25", reference:"qt5-qtwebengine-5.9.3-1.fc25")) flag++;


if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "qt5-qtwebengine");
}
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-4D90E9FC97.NASL
    descriptionAn update of QtWebEngine to the security and bugfix release 5.9.3, including : - Security fixes from Chromium up to version 62.0.3202.89. Including: CVE-2017-5124, CVE-2017-5126, CVE-2017-5127, CVE-2017-5128, CVE-2017-5129, CVE-2017-5132, CVE-2017-5133, CVE-2017-15386, CVE-2017-15387, CVE-2017-15388, CVE-2017-15390, CVE-2017-15392, CVE-2017-15394, CVE-2017-15396, CVE-2017-15398. - QtWebEngineCore: [QTBUG-64032] Fix crash after resizing view to be empty. - QtWebEngine[QML]: Fix loading some favicons including qt.io
    last seen2020-06-05
    modified2017-12-05
    plugin id105010
    published2017-12-05
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105010
    titleFedora 26 : qt5-qtwebengine (2017-4d90e9fc97)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-AAFDBB5554.NASL
    descriptionUpdate to Chromium 65. For EPEL7, it has been a long time since a successful build has been possible, so this will fix a LOT of CVEs. CVE-2017-15396 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15422 CVE-2018-6056 CVE-2018-6406 CVE-2018-6057 CVE-2018-6058 CVE-2018-6059 CVE-2018-6060 CVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065 CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070 CVE-2018-6071 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2019-01-03
    plugin id120695
    published2019-01-03
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/120695
    titleFedora 28 : chromium (2018-aafdbb5554)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4020.NASL
    descriptionSeveral vulnerabilities have been discovered in the chromium web browser. In addition, this message serves as an annoucment that security support for chromium in the oldstable release (jessie), Debian 8, is now discontinued. Debian 8 chromium users that desire continued security updates are strongly encouraged to upgrade now to the current stable release (stretch), Debian 9. An alternative is to switch to the firefox browser, which will continue to receive security updates in jessie for some time. - CVE-2017-5124 A cross-site scripting issue was discovered in MHTML. - CVE-2017-5125 A heap overflow issue was discovered in the skia library. - CVE-2017-5126 Luat Nguyen discovered a use-after-free issue in the pdfium library. - CVE-2017-5127 Luat Nguyen discovered another use-after-free issue in the pdfium library. - CVE-2017-5128 Omair discovered a heap overflow issue in the WebGL implementation. - CVE-2017-5129 Omair discovered a use-after-free issue in the WebAudio implementation. - CVE-2017-5131 An out-of-bounds write issue was discovered in the skia library. - CVE-2017-5132 Guarav Dewan discovered an error in the WebAssembly implementation. - CVE-2017-5133 Aleksandar Nikolic discovered an out-of-bounds write issue in the skia library. - CVE-2017-15386 WenXu Wu discovered a user interface spoofing issue. - CVE-2017-15387 Jun Kokatsu discovered a way to bypass the content security policy. - CVE-2017-15388 Kushal Arvind Shah discovered an out-of-bounds read issue in the skia library. - CVE-2017-15389 xisigr discovered a URL spoofing issue. - CVE-2017-15390 Haosheng Wang discovered a URL spoofing issue. - CVE-2017-15391 Joao Lucas Melo Brasio discovered a way for an extension to bypass its limitations. - CVE-2017-15392 Xiaoyin Liu discovered an error the implementation of registry keys. - CVE-2017-15393 Svyat Mitin discovered an issue in the devtools. - CVE-2017-15394 Sam discovered a URL spoofing issue. - CVE-2017-15395 Johannes Bergman discovered a NULL pointer dereference issue. - CVE-2017-15396 Yuan Deng discovered a stack overflow issue in the v8 JavaScript library.
    last seen2020-06-01
    modified2020-06-02
    plugin id104414
    published2017-11-07
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104414
    titleDebian DSA-4020-1 : chromium-browser - security update
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-3082.NASL
    descriptionAn update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Chromium is an open source web browser, powered by WebKit (Blink). This update upgrades Chromium to version 62.0.3202.75. Security Fix(es) : * A flaw was found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2017-15396)
    last seen2020-05-31
    modified2017-10-31
    plugin id104267
    published2017-10-31
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104267
    titleRHEL 6 : chromium-browser (RHSA-2017:3082)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_3CD46257BBC511E7A3BCE8E0B747A45A.NASL
    descriptionGoogle Chrome Releases reports : 2 security fixes in this release, including : - [770452] High CVE-2017-15396: Stack overflow in V8. Reported by Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30 - [770450] Medium CVE-2017-15406: Stack overflow in V8. Reported by Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30
    last seen2020-06-01
    modified2020-06-02
    plugin id104227
    published2017-10-30
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104227
    titleFreeBSD : chromium -- Stack overflow in V8 (3cd46257-bbc5-11e7-a3bc-e8e0b747a45a)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-15B815B9B7.NASL
    descriptionAn update of QtWebEngine to the security and bugfix release 5.9.3, including : - Security fixes from Chromium up to version 62.0.3202.89. Including: CVE-2017-5124, CVE-2017-5126, CVE-2017-5127, CVE-2017-5128, CVE-2017-5129, CVE-2017-5132, CVE-2017-5133, CVE-2017-15386, CVE-2017-15387, CVE-2017-15388, CVE-2017-15390, CVE-2017-15392, CVE-2017-15394, CVE-2017-15396, CVE-2017-15398. - QtWebEngineCore: [QTBUG-64032] Fix crash after resizing view to be empty. - QtWebEngine[QML]: Fix loading some favicons including qt.io
    last seen2020-06-05
    modified2018-01-15
    plugin id105822
    published2018-01-15
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105822
    titleFedora 27 : qt5-qtwebengine (2017-15b815b9b7)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-FAFF5F661E.NASL
    descriptionUpdate to Chromium 65. For EPEL7, it has been a long time since a successful build has been possible, so this will fix a LOT of CVEs. CVE-2017-15396 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15422 CVE-2018-6056 CVE-2018-6406 CVE-2018-6057 CVE-2018-6058 CVE-2018-6059 CVE-2018-6060 CVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065 CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070 CVE-2018-6071 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2018-03-28
    plugin id108679
    published2018-03-28
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108679
    titleFedora 27 : chromium (2018-faff5f661e)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-1221.NASL
    descriptionThis update to Chromium 62.0.3202.75 fixes the following security issues : - CVE-2017-5124: UXSS with MHTML - CVE-2017-5125: Heap overflow in Skia - CVE-2017-5126: Use after free in PDFium - CVE-2017-5127: Use after free in PDFium - CVE-2017-5128: Heap overflow in WebGL - CVE-2017-5129: Use after free in WebAudio - CVE-2017-5132: Incorrect stack manipulation in WebAssembly. - CVE-2017-5130: Heap overflow in libxml2 - CVE-2017-5131: Out of bounds write in Skia - CVE-2017-5133: Out of bounds write in Skia - CVE-2017-15386: UI spoofing in Blink - CVE-2017-15387: Content security bypass - CVE-2017-15388: Out of bounds read in Skia - CVE-2017-15389: URL spoofing in OmniBox - CVE-2017-15390: URL spoofing in OmniBox - CVE-2017-15391: Extension limitation bypass in Extensions. - CVE-2017-15392: Incorrect registry key handling in PlatformIntegration - CVE-2017-15393: Referrer leak in Devtools - CVE-2017-15394: URL spoofing in extensions UI - CVE-2017-15395: NULL pointer dereference in ImageCapture - CVE-2017-15396: Stack overflow in V8
    last seen2020-06-05
    modified2017-10-30
    plugin id104244
    published2017-10-30
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104244
    titleopenSUSE Security Update : chromium (openSUSE-2017-1221)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201711-02.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201711-02 (Chromium, Google Chrome: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the referenced CVE identifier and Google Chrome Releases for details. Impact : A remote attack may be able to execute arbitrary code, cause a Denial of Service condition, or have other unspecified impacts. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id104510
    published2017-11-13
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104510
    titleGLSA-201711-02 : Chromium, Google Chrome: Multiple vulnerabilities

Redhat

advisories
rhsa
idRHSA-2017:3082
rpms
  • chromium-browser-0:62.0.3202.75-1.el6_9
  • chromium-browser-debuginfo-0:62.0.3202.75-1.el6_9

References