CVE-2017-5078
Fixed in a distro release EPSS 3%
Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as * have an incorrect interaction with xdg-email in xdg-utils, and a space character can be used in front of a command-line argument.
Products: google chrome, redhat enterprise_linux_desktop, redhat enterprise_linux_server, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | chromium | 59.0.3071.86-1 |
| Red Hat rhel extras 6 | chromium-browser | 0:59.0.3071.86-1.el6_9 |
| Red Hat rhel extras 6 | chromium-browser-debuginfo | 0:59.0.3071.86-1.el6_9 |
| SUSE Package Hub 12 SP2 | chromium | 59.0.3071.86-20.1 |
| Ubuntu 14.04 LTS | chromium-browser | 59.0.3071.109-0ubuntu0.14.04.1186 |
| Ubuntu 16.04 LTS | chromium-browser | 59.0.3071.109-0ubuntu0.16.04.1289 |
| Ubuntu 16.04 LTS | oxide-qt | no fix |
| openSUSE Tumbleweed | chromium | 93.0.4577.82-1.1 |
| openSUSE Tumbleweed | chromium | 113.0.5672.92-1.1 |