CVE-2017-5057
HighSummary
Type confusion in PDFium in Google Chrome prior to version 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
Risk Assessment
An attacker could exploit this vulnerability to gain access to sensitive data in memory, potentially leading to further attacks on user systems.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability and to monitor systems for suspicious activity related to opening PDF files.
Other vulnerabilities in PDFium w Google Chrome
See all- CVE-2017-5114High
Inappropriate use of partition alloc in PDFium in Google Chrome prior to version 61.0.3163.79 for Linux, Windows, and Mac, and prior to version 61.0.3163.81 for Android, allowed a remote attacker to potentially exploit memory corruption via a crafted PDF file.
- CVE-2017-5039High
A use after free in PDFium in Google Chrome prior to version 57.0.2987.98 for Mac, Windows, and Linux and prior to version 57.0.2987.108 for Android allows a remote attacker to potentially exploit heap corruption via a crafted PDF file.
- CVE-2017-5036High
A use after free in PDFium in Google Chrome prior to version 57.0.2987.98 for Mac, Windows, and Linux and prior to version 57.0.2987.108 for Android allowed a remote attacker to have an unspecified impact via a crafted PDF file.
- CVE-2017-5034High
A use after free in PDFium in Google Chrome prior to version 57.0.2987.98 for Linux and Windows allows a remote attacker to perform an out of bounds memory read via a crafted PDF file.
- CVE-2017-5032High
PDFium in Google Chrome prior to version 57.0.2987.98 for Windows could be made to increment off the end of a buffer, allowing a remote attacker to potentially exploit heap corruption via a crafted PDF file.
- CVE-2016-5210High
Heap buffer overflow during TIFF image parsing in PDFium in Google Chrome prior to version 55.0.2883.75 for Mac, Windows, and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
- CVE-2016-5203High
A use after free in PDFium in Google Chrome prior to version 55.0.2883.75 for Mac, Windows, and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
- CVE-2016-5184High
PDFium in Google Chrome prior to version 54.0.2840.59 for Windows, Mac, and Linux; and 54.0.2840.85 for Android incorrectly handled object lifecycles in CFFL_FormFillter::KillFocusForAnnot. This allowed a remote attacker to potentially exploit heap corruption via crafted PDF files.
- CVE-2016-1619High
Multiple integer overflows in the sycc422_to_rgb and sycc444_to_rgb functions in PDFium, used in Google Chrome before version 48.0.2564.82, allow remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document.
- CVE-2015-6778High
The CJBig2_SymbolDict class in PDFium, used in Google Chrome before version 47.0.2526.73, allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a PDF document containing crafted data with JBIG2 compression.
Original NVD description (English source)
Type confusion in PDFium in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.