CVE-2017-5033

Publication date 10 March 2017

Last updated 25 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

4.3 · Medium

Score breakdown

Description

Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page, related to the unsafe-inline keyword.

Status

Package Ubuntu Release Status
chromium-browser 17.04 zesty
Fixed in 57.0.2987.98-0ubuntu1.1348
16.10 yakkety
Fixed in 57.0.2987.98-0ubuntu0.16.10.1344
16.04 LTS xenial
Fixed in 57.0.2987.98-0ubuntu0.16.04.1276
14.04 LTS trusty
Fixed in 58.0.3029.81-0ubuntu0.14.04.1172
12.04 LTS precise Ignored
oxide-qt 17.04 zesty
Fixed in 1.21.5-0ubuntu1
16.10 yakkety
Fixed in 1.21.5-0ubuntu0.16.10.1
16.04 LTS xenial
Fixed in 1.21.5-0ubuntu0.16.04.1
14.04 LTS trusty
Fixed in 1.21.5-0ubuntu0.14.04.1
12.04 LTS precise Not in release

Severity score breakdown

CVSS version: CVSS v3.0

Base score 4.3 · Medium

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

Related Ubuntu Security Notices (USN)

Other references

Access our resources on patching vulnerabilities