CVE-2017-15405

{"containers": {"cna": {"affected": [{"product": "Chrome", "vendor": "Google", "versions": [{"lessThan": "61.0.3163.113", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2019-01-09T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Inappropriate symlink handling and a race condition in the stateful recovery feature implementation could lead to a persistance established by a malicious code running with root privileges in cryptohomed in Google Chrome on Chrome OS prior to 61.0.3163.113 allowed a local attacker to execute arbitrary code via a crafted HTML page."}], "problemTypes": [{"descriptions": [{"description": "Race", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-01-09T18:57:01.000Z", "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://crbug.com/766276"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://chromereleases.googleblog.com/2017/10/stable-channel-updates-for-chrome-os.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@google.com", "ID": "CVE-2017-15405", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Chrome", "version": {"version_data": [{"version_affected": "<", "version_value": "61.0.3163.113"}]}}]}, "vendor_name": "Google"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Inappropriate symlink handling and a race condition in the stateful recovery feature implementation could lead to a persistance established by a malicious code running with root privileges in cryptohomed in Google Chrome on Chrome OS prior to 61.0.3163.113 allowed a local attacker to execute arbitrary code via a crafted HTML page."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Race"}]}]}, "references": {"reference_data": [{"name": "https://crbug.com/766276", "refsource": "MISC", "url": "https://crbug.com/766276"}, {"name": "https://chromereleases.googleblog.com/2017/10/stable-channel-updates-for-chrome-os.html", "refsource": "CONFIRM", "url": "https://chromereleases.googleblog.com/2017/10/stable-channel-updates-for-chrome-os.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T19:57:25.933Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://crbug.com/766276"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://chromereleases.googleblog.com/2017/10/stable-channel-updates-for-chrome-os.html"}]}]}, "cveMetadata": {"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "assignerShortName": "Chrome", "cveId": "CVE-2017-15405", "datePublished": "2019-01-09T19:00:00.000Z", "dateReserved": "2017-10-17T00:00:00.000Z", "dateUpdated": "2024-08-05T19:57:25.933Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Chrome", "vendor": "Google", "versions": [{"lessThan": "61.0.3163.113", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "chrome-cve-admin@google.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "A79C7C71-F89D-47B6-B58D-570FA10A5359", "versionEndExcluding": "61.0.3163.113", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Inappropriate symlink handling and a race condition in the stateful recovery feature implementation could lead to a persistance established by a malicious code running with root privileges in cryptohomed in Google Chrome on Chrome OS prior to 61.0.3163.113 allowed a local attacker to execute arbitrary code via a crafted HTML page."}, {"lang": "es", "value": "La gesti\u00f3n de symlink inapropiada y una condici\u00f3n de carrera en la implementaci\u00f3n de la funcionalidad de recuperaci\u00f3n de estado podr\u00eda provocar una persistencia establecida por c\u00f3digo malicioso que se ejecuta con privilegios root en cryptohomed en Google Chrome en Chroms OS, en sus versiones anteriores a la 61.0.3163.113, permiti\u00f3 a un atacante local ejecutar c\u00f3digo arbitrario mediante una p\u00e1gina HTML manipulada."}], "id": "CVE-2017-15405", "lastModified": "2026-06-17T01:07:46.453", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-01-09T19:29:00.917", "references": [{"source": "chrome-cve-admin@google.com", "url": "https://chromereleases.googleblog.com/2017/10/stable-channel-updates-for-chrome-os.html"}, {"source": "chrome-cve-admin@google.com", "url": "https://crbug.com/766276"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://chromereleases.googleblog.com/2017/10/stable-channel-updates-for-chrome-os.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://crbug.com/766276"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}