CVE-2017-5125 describes a heap buffer overflow vulnerability in Skia, a graphics engine used by Google Chrome prior to version 62.0.3202.62, affecting various Debian and Google Chrome products. This high-severity vulnerability (CVSS 8.8) allows a remote attacker to potentially exploit heap corruption and achieve high impact to confidentiality, integrity, and availability through a crafted HTML page, requiring user interaction. While there is no known active exploitation or publicly available exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating awareness despite its inactive status on the Hot List.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 62.0.3202.62CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.