A stack buffer overflow in V8 in Google Chrome prior to 62.0.3202.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

The version of Google Chrome installed on the remote Windows host is prior to 62.0.3202.75. It is, therefore, affected by multiple vulnerabilities as referenced in the 2017_10_stable-channel-update-for-desktop_26 advisory.

  - A stack buffer overflow in V8 in Google Chrome prior to 62.0.3202.75 allowed a remote attacker to perform     an out of bounds memory read via a crafted HTML page. (CVE-2017-15406)

  - A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before     60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2017-15396)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 62.0.3202.75. It is, therefore, affected by multiple vulnerabilities as referenced in the 2017_10_stable-channel-update-for-desktop_26 advisory.

  - A stack buffer overflow in V8 in Google Chrome prior to 62.0.3202.75 allowed a remote attacker to perform     an out of bounds memory read via a crafted HTML page. (CVE-2017-15406)

  - A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before     60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2017-15396)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A stack buffer overflow in V8 in Google Chrome prior to 62.0.3202.75 allowed a remote attacker to perform     an out of bounds memory read via a crafted HTML page. (CVE-2017-15406)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2017:3082 advisory.

  - , CVE-2017-15406 chromium-browser: stack overflow in v8 (CVE-2017-15396, CVE-2017-15406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Google Chrome Releases reports :

2 security fixes in this release, including :

- [770452] High CVE-2017-15396: Stack overflow in V8. Reported by Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30

- [770450] Medium CVE-2017-15406: Stack overflow in V8. Reported by Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30

ID	Name	Product	Family	Severity
275871	Google Chrome < 62.0.3202.75 Multiple Vulnerabilities	Nessus	Windows	high
275850	Google Chrome < 62.0.3202.75 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
251804	Linux Distros Unpatched Vulnerability : CVE-2017-15406	Nessus	Misc.	high
104267	RHEL 6 : chromium-browser (RHSA-2017:3082)	Nessus	Red Hat Local Security Checks	high
104227	FreeBSD : chromium -- Stack overflow in V8 (3cd46257-bbc5-11e7-a3bc-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-15406

high

Tenable Plugins

high

high

high

high

high