CVE-2017-5061

Description

A race condition in navigation in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
• v2.0•LOW•Score: 2.6AV:N/AC:H/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 0.26%• Percentile: 49%

Techniques & Countermeasures

• CWE-362•Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected Systems

• google•chrome

  < 58.0.3029.81

• redhat•enterprise_linux_desktop

  6.0

• redhat•enterprise_linux_server

  6.0

• redhat•enterprise_linux_workstation

  6.0

References (6)

• https://access.redhat.com/errata/RHSA-2017:1124
• https://security.gentoo.org/glsa/201705-02
• http://www.securitytracker.com/id/1038317
• https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html
• https://crbug.com/672847
• http://www.securityfocus.com/bid/97939