CVE-2008-6998: Buffer Overflow

Published Aug 18, 2009

Updated

Stack-based buffer overflow in chrome/common/gfx/urlelider.cc in Google Chrome 0.2.149.27 and other versions before 0.2.149.29 might allow user-assisted remote attackers to execute arbitrary code via a link target (href attribute) with a large number of path elements, which triggers the overflow when the status bar is updated after the user hovers over the link.

Affected Software

1 affected component

Google Chrome=0.2.149.27

Remediation

Patch Available

http://src.chromium.org/viewvc/chrome/branches/chrome_official_branch/src/chrome/common/gfx/url_elider.cc?r1=1774&r2=1797&pathrev=1797

Event History

Aug 18, 2009

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-6998?

CVE-2008-6998 has a severity rating that indicates it can lead to arbitrary code execution if exploited.

How do I fix CVE-2008-6998?

To mitigate CVE-2008-6998, upgrade Google Chrome to a version later than 0.2.149.29.

Who is affected by CVE-2008-6998?

CVE-2008-6998 primarily affects users of Google Chrome version 0.2.149.27 and earlier versions.

What type of vulnerability is CVE-2008-6998?

CVE-2008-6998 is classified as a stack-based buffer overflow vulnerability.

Can CVE-2008-6998 be exploited remotely?

Yes, CVE-2008-6998 can be exploited by user-assisted remote attackers.