CVE-2018-16069: Buffer Overflow

Q: What does an attacker need to exploit this issue?

An attacker needs to persuade a user to visit a crafted HTML page. The attack is remote and requires no attacker privileges, but it requires user interaction.

Q: What information could be exposed?

The flaw can allow cross-origin data to be leaked. The stated impact is confidentiality loss; integrity and availability impacts are not identified.

Q: Which browser versions are known to be affected?

Google Chrome versions prior to 69.0.3497.81 are affected according to the provided data. The issue is also listed for Red Hat and Debian Chromium browser packages, but no package version information is provided.

Published Sep 5, 2018

Updated

An out of bounds read flaw was found in the SwiftShader component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=848238

External References:

https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html

Other sources

Unintended floating-point error accumulation in SwiftShader in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

— MITRE

Affected Software

3 affected componentsFixes available

redhat/chromium-browser<69.0.3497.81

69.0.3497.81

Google Chrome<69.0.3497.81

debian/chromium-browser

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 69.0.3497.81
Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 69.0.3497.81

Event History

Jun 27, 2019

CVE Published

via MITRE·04:13 PM

Data Sourced

via MITRE·04:13 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

DSA-4289

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to persuade a user to visit a crafted HTML page. The attack is remote and requires no attacker privileges, but it requires user interaction.

What information could be exposed?

The flaw can allow cross-origin data to be leaked. The stated impact is confidentiality loss; integrity and availability impacts are not identified.

Which browser versions are known to be affected?

Google Chrome versions prior to 69.0.3497.81 are affected according to the provided data. The issue is also listed for Red Hat and Debian Chromium browser packages, but no package version information is provided.

CVE-2018-16069: Buffer Overflow

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What does an attacker need to exploit this issue?

What information could be exposed?

Which browser versions are known to be affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What information could be exposed?

Which browser versions are known to be affected?