CVE-2017-5015 - Vulnerability Details - OpenCVE

Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled Unicode glyphs, which allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Google	Chrome
Redhat	Rhel Extras

Configuration 1 [-]

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 6 Supplementary
chromium-browser-0:56.0.2924.76-1.el6	cpe:/a:redhat:rhel_extras:6	RHSA-2017:0206	2017-01-26T00:00:00Z

References

Link	Providers
http://rhn.redhat.com/errata/RHSA-2017-0206.html
http://www.debian.org/security/2017/dsa-3776
http://www.securityfocus.com/bid/95792
http://www.securitytracker.com/id/1037718
https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html
https://crbug.com/673971
https://nvd.nist.gov/vuln/detail/CVE-2017-5015
https://security.gentoo.org/glsa/201701-66
https://www.cve.org/CVERecord?id=CVE-2017-5015

History

No history.

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2017-02-17T07:45:00

Updated: 2024-08-05T14:47:44.112Z

Reserved: 2017-01-02T00:00:00

Link: CVE-2017-5015

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2017-02-17T07:59:00.497

Modified: 2025-04-20T01:37:25.860

Link: CVE-2017-5015

Redhat

Severity : Moderate

Publid Date: 2017-01-25T00:00:00Z

Links: CVE-2017-5015 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android", "vendor": "n/a", "versions": [{"status": "affected", "version": "Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android"}]}], "datePublic": "2017-01-25T00:00:00", "descriptions": [{"lang": "en", "value": "Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled Unicode glyphs, which allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name."}], "problemTypes": [{"descriptions": [{"description": "insufficient policy enforcement", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-04T19:57:01", "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome"}, "references": [{"name": "95792", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/95792"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html"}, {"name": "GLSA-201701-66", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201701-66"}, {"name": "RHSA-2017:0206", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2017-0206.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://crbug.com/673971"}, {"name": "1037718", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1037718"}, {"name": "DSA-3776", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2017/dsa-3776"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@google.com", "ID": "CVE-2017-5015", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android", "version": {"version_data": [{"version_value": "Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled Unicode glyphs, which allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "insufficient policy enforcement"}]}]}, "references": {"reference_data": [{"name": "95792", "refsource": "BID", "url": "http://www.securityfocus.com/bid/95792"}, {"name": "https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html", "refsource": "CONFIRM", "url": "https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html"}, {"name": "GLSA-201701-66", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201701-66"}, {"name": "RHSA-2017:0206", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2017-0206.html"}, {"name": "https://crbug.com/673971", "refsource": "CONFIRM", "url": "https://crbug.com/673971"}, {"name": "1037718", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1037718"}, {"name": "DSA-3776", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2017/dsa-3776"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T14:47:44.112Z"}, "title": "CVE Program Container", "references": [{"name": "95792", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/95792"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html"}, {"name": "GLSA-201701-66", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201701-66"}, {"name": "RHSA-2017:0206", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2017-0206.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://crbug.com/673971"}, {"name": "1037718", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1037718"}, {"name": "DSA-3776", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2017/dsa-3776"}]}]}, "cveMetadata": {"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "assignerShortName": "Chrome", "cveId": "CVE-2017-5015", "datePublished": "2017-02-17T07:45:00", "dateReserved": "2017-01-02T00:00:00", "dateUpdated": "2024-08-05T14:47:44.112Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "20E75B30-0D25-4AC2-8506-1D29C8B87E77", "versionEndIncluding": "55.0.2883.87", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled Unicode glyphs, which allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name."}, {"lang": "es", "value": "Google Chrome en versiones anteriores a 56.0.2924.76 para Linux, Windows y Mac y 56.0.2924.87 para Android, manej\u00f3 incorrectamente glifos Unicode, lo que permiti\u00f3 a un atacante remoto realizar suplantaciones de dominio a trav\u00e9s de hom\u00f3grafos de IDN en un nombre de dominio manipulado."}], "id": "CVE-2017-5015", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-02-17T07:59:00.497", "references": [{"source": "chrome-cve-admin@google.com", "url": "http://rhn.redhat.com/errata/RHSA-2017-0206.html"}, {"source": "chrome-cve-admin@google.com", "url": "http://www.debian.org/security/2017/dsa-3776"}, {"source": "chrome-cve-admin@google.com", "url": "http://www.securityfocus.com/bid/95792"}, {"source": "chrome-cve-admin@google.com", "url": "http://www.securitytracker.com/id/1037718"}, {"source": "chrome-cve-admin@google.com", "url": "https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html"}, {"source": "chrome-cve-admin@google.com", "url": "https://crbug.com/673971"}, {"source": "chrome-cve-admin@google.com", "url": "https://security.gentoo.org/glsa/201701-66"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2017-0206.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2017/dsa-3776"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/95792"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1037718"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://crbug.com/673971"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201701-66"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}