CVE-2019-5759

Published: Feb 19, 2019Modified: Nov 21, 2024

9.6

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 6.0

Source: NVD

Description

Incorrect lifetime handling in HTML select elements in Google Chrome on Android and Mac prior to 72.0.3626.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

Affected (7)

Products: Google: Chrome · Debian: Debian Linux · Redhat: Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Workstation · +1 more

Show all products

Google: Chrome · Debian: Debian Linux · Redhat: Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Workstation · Fedoraproject: Fedora

1 product

1 product

3 products

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Workstation

Fedoraproject

1 product

Fedora

Configuration A

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Google Chrome	Before 72.0.3626.81

Running on/with	Platform Versions
Apple Macos	All versions
Google Android	All versions

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Workstation	Version 6.0

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 29
Fedoraproject Fedora	Version 30

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (14)

http://www.securityfocus.com/bid/106767

Source: chrome-cve-admin@google.com

https://access.redhat.com/errata/RHSA-2019:0309

Source: chrome-cve-admin@google.com

https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html

Source: chrome-cve-admin@google.com

https://crbug.com/912211

Source: chrome-cve-admin@google.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JVFHYCJGMZQUKYSIE2BXE4NLEGFGUXU5/

Source: chrome-cve-admin@google.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQOP53LXXPRGD4N5OBKGQTSMFXT32LF6/

Source: chrome-cve-admin@google.com

https://www.debian.org/security/2019/dsa-4395

Source: chrome-cve-admin@google.com

http://www.securityfocus.com/bid/106767