CVE-2018-18343: Use After Free
An use after free flaw was found in the Skia component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=882423
External References:
https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
Other sources
Incorrect handing of paths leading to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/chromium-browserto a version that resolves this vulnerability.Fixed in 71.0.3578.80 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 71.0.3578.80
Event History
Frequently Asked Questions
What is CVE-2018-18343?
CVE-2018-18343 refers to an incorrect handling of paths leading to a use after free vulnerability in Skia in Google Chrome prior to version 71.0.3578.80.
How can a remote attacker exploit CVE-2018-18343?
A remote attacker can potentially exploit the vulnerability by crafting a malicious HTML page that triggers heap corruption.
Which software versions are affected by CVE-2018-18343?
Google Chrome versions prior to 71.0.3578.80, Redhat Linux Desktop 6.0, Redhat Linux Server 6.0, Redhat Linux Workstation 6.0, and Debian Debian Linux 9.0 are affected.
What is the severity of CVE-2018-18343?
CVE-2018-18343 has a high severity rating of 8.8.
How can I fix CVE-2018-18343?
To fix CVE-2018-18343, update Google Chrome to version 71.0.3578.80 or later. For other affected software, follow the remediation steps provided by the respective vendors.