CVE-2018-20066: Use After Free

Q: What is the severity of CVE-2018-20066?

CVE-2018-20066 has a medium severity rating due to its potential for exploitation through heap corruption.

Q: How do I fix CVE-2018-20066?

To fix CVE-2018-20066, upgrade Google Chrome to version 71.0.3578.80 or later.

Q: What versions of Google Chrome are affected by CVE-2018-20066?

CVE-2018-20066 affects Google Chrome versions prior to 71.0.3578.80.

Q: Who can exploit CVE-2018-20066?

A remote attacker could exploit CVE-2018-20066 by using a crafted HTML page to cause heap corruption.

Q: What type of attack does CVE-2018-20066 involve?

CVE-2018-20066 involves a potential heap corruption attack through vulnerabilities in the object lifecycle of extensions.

Published Jan 9, 2019

Updated

Incorrect object lifecycle in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Affected Software

2 affected componentsFixes available

Google Chrome<71.0.3578.80

debian/chromium

150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1

Event History

Jan 9, 2019

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

DSA-4352

Frequently Asked Questions

What is the severity of CVE-2018-20066?

CVE-2018-20066 has a medium severity rating due to its potential for exploitation through heap corruption.

How do I fix CVE-2018-20066?