CVE-2017-5048 : Security Advisory and Response
Learn about CVE-2017-5048 affecting Google Chrome versions prior to 57.0.2987.98 for Mac, Windows, and Linux, and 57.0.2987.108 for Android. Find out how to mitigate this integer overflow vulnerability.
Google Chrome prior to version 57.0.2987.98 for Mac, Windows, and Linux, and 57.0.2987.108 for Android is affected by an integer overflow vulnerability in FFmpeg. This could allow a remote attacker to execute an out-of-bounds memory write using a specially crafted video file.
Understanding CVE-2017-5048
A remote attacker could exploit an integer overflow in FFmpeg in Google Chrome versions before 57.0.2987.98 for Mac, Windows, and Linux, as well as 57.0.2987.108 for Android, to perform an out-of-bounds memory write via a crafted video file.
What is CVE-2017-5048?
- An integer overflow vulnerability in FFmpeg in Google Chrome
- Allows a remote attacker to execute an out-of-bounds memory write
- Occurs in versions prior to 57.0.2987.98 for Mac, Windows, and Linux, and 57.0.2987.108 for Android
The Impact of CVE-2017-5048
- A remote attacker could execute an out-of-bounds memory write
- Exploited using a specifically crafted video file in FFmpeg
- Due to an integer overflow in Google Chrome
Technical Details of CVE-2017-5048
Google Chrome prior to version 57.0.2987.98 for Mac, Windows, and Linux, and 57.0.2987.108 for Android is affected by an integer overflow vulnerability in FFmpeg.
Vulnerability Description
- An integer overflow in FFmpeg allows a remote attacker to perform an out-of-bounds memory write
- Exploited using a specially crafted video file, ChunkDemuxer
Affected Systems and Versions
- Google Chrome versions before 57.0.2987.98 for Mac, Windows, and Linux
- Google Chrome version 57.0.2987.108 for Android
Exploitation Mechanism
- Remote attacker exploits an integer overflow in FFmpeg
- Crafted video file triggers out-of-bounds memory write
Mitigation and Prevention
Google Chrome users should take immediate steps to mitigate the CVE-2017-5048 vulnerability.
Immediate Steps to Take
- Update Google Chrome to version 57.0.2987.98 for Mac, Windows, and Linux, and 57.0.2987.108 for Android
- Avoid opening untrusted video files from unknown sources
Long-Term Security Practices
- Regularly update Google Chrome to the latest version
- Exercise caution when downloading and opening video files from the internet
Patching and Updates
- Google Chrome users should apply the latest security patches and updates to prevent exploitation of this vulnerability