CVE-2018-18343: Use After Free
First published: Wed Dec 05 2018(Updated: )
An use after free flaw was found in the Skia component of the Chromium browser. Upstream bug(s): <a href="https://code.google.com/p/chromium/issues/detail?id=882423">https://code.google.com/p/chromium/issues/detail?id=882423</a> External References: <a href="https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html">https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html</a>
Credit: cve-coordination@google.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Chrome | <71.0.3578.80 | |
| Redhat Linux Desktop | =6.0 | |
| Redhat Linux Server | =6.0 | |
| Redhat Linux Workstation | =6.0 | |
| Debian Debian Linux | =9.0 | |
| debian/chromium | 90.0.4430.212-1~deb10u1 116.0.5845.180-1~deb11u1 120.0.6099.129-1~deb11u1 119.0.6045.199-1~deb12u1 120.0.6099.129-1~deb12u1 120.0.6099.129-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/106084
- https://access.redhat.com/errata/RHSA-2018:3803
- https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
- https://crbug.com/882423
- https://security.gentoo.org/glsa/201908-18
- https://www.debian.org/security/2018/dsa-4352
- https://code.google.com/p/chromium/issues/detail?id=882423
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1656576
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1656575
- https://bugzilla.redhat.com/show_bug.cgi?id=1656557
- https://security-tracker.debian.org/tracker/CVE-2018-18343
Frequently Asked Questions
What is CVE-2018-18343?
CVE-2018-18343 refers to an incorrect handling of paths leading to a use after free vulnerability in Skia in Google Chrome prior to version 71.0.3578.80.
How can a remote attacker exploit CVE-2018-18343?
A remote attacker can potentially exploit the vulnerability by crafting a malicious HTML page that triggers heap corruption.
Which software versions are affected by CVE-2018-18343?
Google Chrome versions prior to 71.0.3578.80, Redhat Linux Desktop 6.0, Redhat Linux Server 6.0, Redhat Linux Workstation 6.0, and Debian Debian Linux 9.0 are affected.
What is the severity of CVE-2018-18343?
CVE-2018-18343 has a high severity rating of 8.8.
How can I fix CVE-2018-18343?
To fix CVE-2018-18343, update Google Chrome to version 71.0.3578.80 or later. For other affected software, follow the remediation steps provided by the respective vendors.
- collector/security-tracker-debian
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/severity
- agent/references
- agent/author
- agent/weakness
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-18343
- agent/software-canonical-lookup
- agent/tags
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- package-manager/debian
- vendor/google
- canonical/google chrome
- vendor/redhat
- canonical/redhat linux desktop
- version/redhat linux desktop/6.0
- canonical/redhat linux server
- version/redhat linux server/6.0
- canonical/redhat linux workstation
- version/redhat linux workstation/6.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- package-manager/redhat