Electron vulnerable to URL spoofing via PDFium

보통 4.3CVE-2017-1000424 · GHSA-6h98-cf9g-vmg2 · Published 02/01/2018 · updated 17/06/2026

요약

CVE-2017-1000424은(는) electron (atom), electron에 영향을 주는 보통 (CVSS 4.3) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.98%, 전체 취약점의 62.3%보다 높음.
조치: 1.7.6 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
electron atom	`≥ 1.6.4, ≤ 1.6.11≥ 1.7.0, ≤ 1.7.5`	No fix yet
electron npm	`≥ 1.7.0, < 1.7.6`	`1.7.6`

Description

Electron version 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.

NVD description

Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.

References

nvd.nist.gov/vuln/detail/CVE-2017-1000424 · ADVISORY
electron/electron#10008 · WEB
electron/electron#10008 · WEB
electron/electron · PACKAGE
electron/electron release v1.7.6 · WEB

electron의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

electron

atom

≥ 1.6.4, ≤ 1.6.11≥ 1.7.0, ≤ 1.7.5

No fix yet

electron

npm

≥ 1.7.0, < 1.7.6

1.7.6

Description

Electron version 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.

NVD description

Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.

electron의 다른 취약점

모두 보기 →