Vulnerability Name:

CVE-2017-5081 (CCN-126949)

Assigned:2017-06-05
Published:2017-06-05
Updated:2022-04-06
Summary:Lack of verification of an extension's locale folder in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed an attacker with local write access to modify extensions by modifying extension files.
CVSS v3 Severity:3.3 Low (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
2.9 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
4.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-20
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2017-5081

Source: BID
Type: Third Party Advisory, VDB Entry
98861

Source: CCN
Type: BID-98861
Google Chrome Prior to 59.0.3071.86 Multiple Security Vulnerabilities

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1038622

Source: REDHAT
Type: Third Party Advisory
RHSA-2017:1399

Source: CCN
Type: Google Chrome Releases Web site
Stable Channel Update for Desktop

Source: MISC
Type: Release Notes, Vendor Advisory
https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html

Source: MISC
Type: Exploit, Issue Tracking, Patch, Vendor Advisory
https://crbug.com/672008

Source: XF
Type: UNKNOWN
google-chrome-cve20175081-sec-bypass(126949)

Source: GENTOO
Type: Third Party Advisory, VDB Entry
GLSA-201706-20

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2017-5081

Vulnerable Configuration:Configuration 1:
  • cpe:/a:google:chrome:*:*:*:*:*:*:*:* (Version < 59.0.3071.86)
  • AND
  • cpe:/o:apple:macos:-:*:*:*:*:*:*:*
  • OR cpe:/o:linux:linux_kernel:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:google:chrome:*:*:*:*:*:*:*:* (Version < 59.0.3071.92)
  • AND
  • cpe:/o:google:android:-:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20175081
    V
    		CVE-2017-5081
    2022-06-30
    oval:org.opensuse.security:def:112066
    P
    		chromedriver-93.0.4577.82-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:105615
    P
    		chromedriver-93.0.4577.82-1.1 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:26343
    P
    		Security update for MozillaThunderbird (Important)
    2020-12-01
    oval:org.opensuse.security:def:25272
    P
    		Security update for vino (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25647
    P
    		Security update for freetype2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:25007
    P
    		Recommended update for NetworkManager (Low)
    2020-12-01
    oval:org.opensuse.security:def:26378
    P
    		Security update for chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:25356
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:25661
    P
    		Security update for opensc (Low)
    2020-12-01
    oval:org.opensuse.security:def:25134
    P
    		Security update for apache2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:25506
    P
    		Security update for openexr (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:24932
    P
    		Security update for java-1_7_1-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:25705
    P
    		Security update for python3 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25215
    P
    		Security update for systemd (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25559
    P
    		Security update for mozilla-nspr, mozilla-nss (Important)
    2020-12-01
    oval:org.opensuse.security:def:24943
    P
    		Security update for python (Important)
    2020-12-01
    oval:com.ubuntu.bionic:def:201750810000000
    V
    		CVE-2017-5081 on Ubuntu 18.04 LTS (bionic) - medium.
    2017-10-27
    oval:com.ubuntu.artful:def:20175081000
    V
    		CVE-2017-5081 on Ubuntu 17.10 (artful) - medium.
    2017-10-27
    oval:com.ubuntu.xenial:def:20175081000
    V
    		CVE-2017-5081 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-10-27
    oval:com.ubuntu.xenial:def:201750810000000
    V
    		CVE-2017-5081 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-10-27
    oval:com.ubuntu.bionic:def:20175081000
    V
    		CVE-2017-5081 on Ubuntu 18.04 LTS (bionic) - medium.
    2017-10-27
    oval:com.ubuntu.cosmic:def:20175081000
    V
    		CVE-2017-5081 on Ubuntu 18.10 (cosmic) - medium.
    2017-10-27
    oval:com.ubuntu.cosmic:def:201750810000000
    V
    		CVE-2017-5081 on Ubuntu 18.10 (cosmic) - medium.
    2017-10-27
    oval:com.ubuntu.trusty:def:20175081000
    V
    		CVE-2017-5081 on Ubuntu 14.04 LTS (trusty) - medium.
    2017-10-27
    BACK
    google chrome *
    apple macos -
    linux linux kernel -
    microsoft windows -
    debian debian linux 9.0
    google chrome *
    google android -
    redhat enterprise linux desktop 6.0
    redhat enterprise linux server 6.0
    redhat enterprise linux workstation 6.0