To what extent Threat Updates covers against the latest CVE's

[mario.chancay]

Hi, we have received notifications for the following vulnerabilities and related CVE's:

Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution

• Out of bounds write in QUIC (CVE-2017-15407)
• Heap buffer overflow in PDFium (CVE-2017-15408)
• Out of bounds write in Skia (CVE-2017-15409)
• Use after free in PDFium (CVE-2017-15410, CVE-2017-15411)
• Use after free in libXML (CVE-2017-15412)
• Type confusion in WebAssembly (CVE-2017-15413)
• Pointer information disclosure in IPC call (CVE-2017-15415)
• Out of bounds read in Blink (CVE-2017-15416)
• Cross origin information disclosure in Skia (CVE-2017-15417)
• Use of uninitialized value in Skia (CVE-2017-15418)
• Cross origin leak of redirect URL in Blink (CVE-2017-15419)
• URL spoofing in Omnibox (CVE-2017-15420)
• Integer overflow in ICU (CVE-2017-15422)
• Issue with SPAKE implementation in BoringSSL (CVE-2017-15423)
• URL Spoof in Omnibox (CVE-2017-15424, CVE-2017-15425, CVE-2017-15426)
• Insufficient blocking of JavaScript in Omnibox (CVE-2017-15427)

Multiple Vulnerabilities in Apache Struts Could Allow for Remote Code Execution

• A denial of service vulnerability exists due to an outdated JSON-lib library utilized by a REST plugin. (CVE-2017-15707)
• A remote code execution vulnerability exists because the REST Plugin utilizes Jackson JSON library for data binding. (CVE-2017-7525)

But could not find the CVE's in the Threat Vault.  Would like to understand how PaloAlto determines which CVE's should be included in the Threat Updates.

Regards

Mario

[reaper]

hi @mario.chancay

some CVE may not have identifiable factors in the network packets: there may be legitimate packets that are able to buffer overflow a certain vulnerable version of client/server but are not malicious in nature, or they may not have been disclosed publicly yet

i've tried to review these CVE but they are marked as reserved on mitre, I then tried tracing the original bug bt I don't appear to have access to chromium bugs 😉

My assumption is these have not been disclosed yet, to allow google to fix the bugs