CVE-2018-20070: Input Validation

Q: What is the severity of CVE-2018-20070?

CVE-2018-20070 has a high severity rating due to its potential for phishing attacks through URL spoofing.

Q: How do I fix CVE-2018-20070?

To mitigate CVE-2018-20070, users should update Google Chrome to version 71.0.3578.80 or later.

Q: What versions of Google Chrome are affected by CVE-2018-20070?

CVE-2018-20070 affects Google Chrome versions prior to 71.0.3578.80.

Q: What type of attack does CVE-2018-20070 enable?

CVE-2018-20070 enables attackers to perform URL spoofing, potentially leading to phishing attacks.

Q: How does CVE-2018-20070 impact users?

CVE-2018-20070 impacts users by allowing malicious actors to deceive them into believing they are visiting legitimate websites.

Published Jan 9, 2019

Updated

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.

Affected Software

2 affected componentsFixes available

Google Chrome<71.0.3578.80

debian/chromium

150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1

Event History

Jan 9, 2019

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

DSA-4352

Frequently Asked Questions

What is the severity of CVE-2018-20070?

CVE-2018-20070 has a high severity rating due to its potential for phishing attacks through URL spoofing.

How do I fix CVE-2018-20070?