CVE-2017-5097
Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for...
8.8 HighFix available
Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for Linux allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
1.67%Up 0.9 points since Apr 14, 2021
What each source reports
NVD Score used
Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for Linux allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
- Record
CVE-2017-5097- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for Linux allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
- Record
CVE-2017-5097- Updated
- 2026-11-02
EUVDEUVD-2017-14206 No score
Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for Linux allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
- Record
EUVD-2017-14206- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rx3v-qj4m-5898
Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for...
Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for Linux allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
- Record
GHSA-rx3v-qj4m-5898- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVRHSA-2017:1833
Red Hat Security Advisory: chromium-browser security update
- Record
RHSA-2017:1833- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-5097
Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for Linux allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
- Record
UBUNTU-CVE-2017-5097- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVMGASA-2017-0317 No score
Chromium-browser 60.0.3112.101 fixes security issues
Multiple flaws were found in the way Chromium 57 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2017-5057, CVE-2017-5058, CVE-2017-5059, CVE-2017-5060, CVE-2017-5061, CVE-2017-5062, CVE-2017-5063, CVE-2017-5064, CVE-2017-5065, CVE-2017-5066, CVE-2017-5067, CVE-2017-5068, CVE-2017-5069, CVE-2017-5070, CVE-2017-5071, CVE-2017-5072, CVE-2017-5073, CVE-2017-5074, CVE-2017-5075, CVE-2017-5076, CVE-2017-5077, CVE-2017-5078, CVE-2017-5079, CVE-2017-5080, CVE-2017-5081, CVE-2017-5082, CVE-2017-5083, CVE-2017-5085, CVE-2017-5086, CVE-2017-5087, CVE-2017-5088, CVE-2017-5089, CVE-2017-5091, CVE-2017-5092, CVE-2017-5093, CVE-2017-5094, CVE-2017-5095, CVE-2017-5096, CVE-2017-5097, CVE-2017-5098, CVE-2017-5099, CVE-2017-5100, CVE-2017-5101, CVE-2017-5102, CVE-2017-5103, CVE-2017-5104, CVE-2017-5105, CVE-2017-5106, CVE-2017-5107, CVE-2017-5108, CVE-2017-5109, CVE-2017-5110, CVE-2017-6991)
- Record
MGASA-2017-0317- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:1993-1 No score
Security update for chromium
This update Chromium to version 60.0.3112.78 fixes security issue and bugs.
The following security issues were fixed:
- CVE-2017-5091: Use after free in IndexedDB
- CVE-2017-5092: Use after free in PPAPI
- CVE-2017-5093: UI spoofing in Blink
- CVE-2017-5094: Type confusion in extensions
- CVE-2017-5095: Out-of-bounds write in PDFium
- CVE-2017-5096: User information leak via Android intents
- CVE-2017-5097: Out-of-bounds read in Skia
- CVE-2017-5098: Use after free in V8
- CVE-2017-5099: Out-of-bounds write in PPAPI
- CVE-2017-5100: Use after free in Chrome Apps
- CVE-2017-5101: URL spoofing in OmniBox
- CVE-2017-5102: Uninitialized use in Skia
- CVE-2017-5103: Uninitialized use in Skia
- CVE-2017-5104: UI spoofing in browser
- CVE-2017-7000: Pointer disclosure in SQLite
- CVE-2017-5105: URL spoofing in OmniBox
- CVE-2017-5106: URL spoofing in OmniBox
- CVE-2017-5107: User information leak via SVG
- CVE-2017-5108: Type confusion in PDFium
- CVE-2017-5109: UI spoofing in browser
- CVE-2017-5110: UI spoofing in payments dialog
- Various fixes from internal audits, fuzzing and other initiatives
A number of upstream bugfixes are also included in this release.
- Record
openSUSE-SU-2017:1993-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:1994-1 No score
Security update for chromium
This update Chromium to version 60.0.3112.78 fixes security issue and bugs.
The following security issues were fixed:
- CVE-2017-5091: Use after free in IndexedDB
- CVE-2017-5092: Use after free in PPAPI
- CVE-2017-5093: UI spoofing in Blink
- CVE-2017-5094: Type confusion in extensions
- CVE-2017-5095: Out-of-bounds write in PDFium
- CVE-2017-5096: User information leak via Android intents
- CVE-2017-5097: Out-of-bounds read in Skia
- CVE-2017-5098: Use after free in V8
- CVE-2017-5099: Out-of-bounds write in PPAPI
- CVE-2017-5100: Use after free in Chrome Apps
- CVE-2017-5101: URL spoofing in OmniBox
- CVE-2017-5102: Uninitialized use in Skia
- CVE-2017-5103: Uninitialized use in Skia
- CVE-2017-5104: UI spoofing in browser
- CVE-2017-7000: Pointer disclosure in SQLite
- CVE-2017-5105: URL spoofing in OmniBox
- CVE-2017-5106: URL spoofing in OmniBox
- CVE-2017-5107: User information leak via SVG
- CVE-2017-5108: Type confusion in PDFium
- CVE-2017-5109: UI spoofing in browser
- CVE-2017-5110: UI spoofing in payments dialog
- Various fixes from internal audits, fuzzing and other initiatives
A number of upstream bugfixes are also included in this release.
- Record
openSUSE-SU-2017:1994-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10681-1 No score
chromedriver-93.0.4577.82-1.1 on GA media
These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10681-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:9 |
before 60.0.3112.78-1~deb9u1, plus listed versions 59.0.3071.104-159.0.3071.86-160.0.3112.72-1 |
60.0.3112.78-1~deb9u1 |
chromium-browser-stableMageia:5 |
before 60.0.3112.101-1.mga5 | 60.0.3112.101-1.mga5 |
libwebpMageia:5 |
before 0.4.3-1.1.mga5 | 0.4.3-1.1.mga5 |
chromium-browser-stableMageia:6 |
before 60.0.3112.101-1.mga6 | 60.0.3112.101-1.mga6 |
chromium-browserRed Hat:rhel_extras:6 |
before 0:60.0.3112.78-1.el6_9 | 0:60.0.3112.78-1.el6_9 |
chromium-browser-debuginfoRed Hat:rhel_extras:6 |
before 0:60.0.3112.78-1.el6_9 | 0:60.0.3112.78-1.el6_9 |
chromium-browserUbuntu:14.04:LTS |
before 60.0.3112.78-0ubuntu0.14.04.1190, plus listed versions 29.0.1547.65-0ubuntu231.0.1650.63-0ubuntu1~20131204.132.0.1700.107-0ubuntu1~20140204.977.133.0.1750.152-0ubuntu1~pkg995.134.0.1847.116-0ubuntu2 Show 29 moreShow less36.0.1985.125-0ubuntu1.14.04.0~pkg102937.0.2062.94-0ubuntu0.14.04.1~pkg104237.0.2062.120-0ubuntu0.14.04.1~pkg104938.0.2125.111-0ubuntu0.14.04.1.106139.0.2171.65-0ubuntu0.14.04.1.106440.0.2214.94-0ubuntu0.14.04.1.106840.0.2214.111-0ubuntu0.14.04.1.106941.0.2272.76-0ubuntu0.14.04.1.107643.0.2357.81-0ubuntu0.14.04.1.108943.0.2357.130-0ubuntu0.14.04.1.109244.0.2403.89-0ubuntu0.14.04.1.109545.0.2454.85-0ubuntu0.14.04.1.109745.0.2454.101-0ubuntu0.14.04.1.109947.0.2526.73-0ubuntu0.14.04.1.110647.0.2526.106-0ubuntu0.14.04.1.110748.0.2564.82-0ubuntu0.14.04.1.110848.0.2564.116-0ubuntu0.14.04.1.111149.0.2623.87-0ubuntu0.14.04.1.111249.0.2623.108-0ubuntu0.14.04.1.111350.0.2661.102-0ubuntu0.14.04.1.111751.0.2704.79-0ubuntu0.14.04.1.112152.0.2743.116-0ubuntu0.14.04.1.113453.0.2785.143-0ubuntu0.14.04.1.114253.0.2785.143-0ubuntu0.14.04.1.114558.0.3029.81-0ubuntu0.14.04.117258.0.3029.96-0ubuntu0.14.04.117458.0.3029.110-0ubuntu0.14.04.117659.0.3071.109-0ubuntu0.14.04.118659.0.3071.109-0ubuntu0.14.04.1188 |
60.0.3112.78-0ubuntu0.14.04.1190 |
chromium-browserUbuntu:16.04:LTS |
before 60.0.3112.78-0ubuntu0.16.04.1293, plus listed versions 45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229 Show 15 moreShow less49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.128159.0.3071.109-0ubuntu0.16.04.128959.0.3071.109-0ubuntu0.16.04.1291 |
60.0.3112.78-0ubuntu0.16.04.1293 |
oxide-qtUbuntu:16.04:LTS |
All versions, plus listed versions 1.9.5-0ubuntu11.10.3-0ubuntu0.15.10.11.10.3-0ubuntu0.15.10.21.11.3-0ubuntu31.11.4-0ubuntu1 Show 17 moreShow less1.11.5-0ubuntu11.12.5-0ubuntu11.12.6-0ubuntu11.12.7-0ubuntu11.13.6-0ubuntu11.14.7-0ubuntu11.14.9-0ubuntu0.16.04.11.15.7-0ubuntu0.16.04.11.15.8-0ubuntu0.16.04.11.16.5-0ubuntu0.16.04.11.17.7-0ubuntu0.16.04.11.17.9-0ubuntu0.16.04.11.18.3-0ubuntu0.16.04.11.18.5-0ubuntu0.16.04.11.19.4-0ubuntu0.16.04.11.20.4-0ubuntu0.16.04.11.21.5-0ubuntu0.16.04.1 |
None known |
chromiumSUSE:Package Hub 12 SP2 |
before 60.0.3112.78-26.1 | 60.0.3112.78-26.1 |
chromiumopenSUSE:Tumbleweed |
before 93.0.4577.82-1.1 | 93.0.4577.82-1.1 |
chromiumopenSUSE:Tumbleweed |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-5097 is a high vulnerability (CVSS 8.8) in Debian Linux, published July 28, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.67%, the 76th percentile. Fixed in chromium-browser 60.0.3112.78-1~deb9u1.
References
security.gentoo.org/glsa/201709-15
crbug.com/740789
debian.org/security/2017/dsa-3926
chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
securityfocus.com/bid/99950
access.redhat.com/errata/RHSA-2017:1833
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-5097
github.com/advisories/GHSA-rx3v-qj4m-5898
advisories.mageia.org/MGASA-2017-0317.html
bugs.mageia.org/show_bug.cgi?id=20708
bugzilla.redhat.com/show_bug.cgi?id=1475193
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1833.json
cve.org/CVERecord?id=CVE-2017-5091
ubuntu.com/security/CVE-2017-5097
lists.opensuse.org/archives/list/[email protected]/thread/VS65OFX6RNZL3MZCZD4LJ6Z5J45F6UIK
bugzilla.suse.com/1050537
suse.com/security/cve/CVE-2017-5091
This page doesn't list everything
Left out here: 2,218 references. The JSON record has them.