« Volver al listado

CVE-2017-5064

Estado: ModificadaAlta (8.8)—

Una gestión incorrecta de cambios de DOM en Blink en Google Chrome, en versiones anteriores a la 58.0.3029.81 para Windows, permitía que un atacante remoto explotase una corrupción de la memoria dinámica (heap) mediante una página HTML manipulada.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Google — Chrome

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-5064",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "chrome-cve-admin@google.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Google Chrome prior to 58.0.3029.81 for Windows",
          "versions": [
            {
              "status": "affected",
              "version": "Google Chrome prior to 58.0.3029.81 for Windows"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-10-27T05:29:00.643",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/97939",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1038317",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:1124",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "https://crbug.com/693974",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "https://security.gentoo.org/glsa/201705-02",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/97939",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1038317",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:1124",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://crbug.com/693974",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201705-02",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect handling of DOM changes in Blink in Google Chrome prior to 58.0.3029.81 for Windows allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page."
    },
    {
      "lang": "es",
      "value": "Una gestión incorrecta de cambios de DOM en Blink en Google Chrome, en versiones anteriores a la 58.0.3029.81 para Windows, permitía que un atacante remoto explotase una corrupción de la memoria dinámica (heap) mediante una página HTML manipulada."
    }
  ],
  "lastModified": "2026-06-17T01:19:51.200",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE8D9B93-C713-498E-9B9A-5146018A975D",
              "versionEndExcluding": "58.0.3029.81"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "chrome-cve-admin@google.com"
}