CVE-2018-6065: (Pwn2Own) Xiaomi Mi6 Browser CalculateInstanceSizeHelper Integer Overflow Remote Code Execution Vulnerability
First published: Wed Mar 07 2018(Updated: )
An integer overflow flaw was found in the V8 component of the Chromium browser. Upstream bug(s): <a href="https://code.google.com/p/chromium/issues/detail?id=808192">https://code.google.com/p/chromium/issues/detail?id=808192</a> External References: <a href="https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html">https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html</a>
Credit: cve-coordination@google.com chrome-cve-admin@google.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/chromium-browser | ||
| debian/libv8 | ||
| Google Chrome | <65.0.3325.146 | |
| Redhat Enterprise Linux Desktop | =6.0 | |
| Redhat Enterprise Linux Server | =6.0 | |
| Redhat Enterprise Linux Workstation | =6.0 | |
| Debian Debian Linux | =9.0 | |
| mi Mi6 Browser | ||
| redhat/chromium-browser | <65.0.3325.146 | 65.0.3325.146 |
| Xiaomi Browser | ||
| Google Chromium V8 | ||
| <65.0.3325.146 | ||
| =6.0 | ||
| =6.0 | ||
| =6.0 | ||
| =9.0 | ||
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2018-6065
- http://www.securityfocus.com/bid/103297
- https://access.redhat.com/errata/RHSA-2018:0484
- https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
- https://crbug.com/808192
- https://www.debian.org/security/2018/dsa-4182
- https://www.exploit-db.com/exploits/44584/
- https://www.zerodayinitiative.com/advisories/ZDI-19-367/
- https://code.google.com/p/chromium/issues/detail?id=808192
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1552502
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1552504
- https://bugzilla.redhat.com/show_bug.cgi?id=1552482
- https://nvd.nist.gov/vuln/detail/CVE-2018-6065
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-6065.
What is the affected software for this vulnerability?
The affected software for this vulnerability includes Google Chromium V8 Engine, Chromium Browser, libv8, Google Chrome, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation, Debian Debian Linux, and Xiaomi Browser.
How can this vulnerability be exploited?
This vulnerability can be exploited by remote attackers who can execute arbitrary code on vulnerable installations of Xiaomi Mi6 Browser through user interaction, such as visiting a malicious page or opening a malicious file.
What is the severity of CVE-2018-6065?
CVE-2018-6065 has a severity rating of 8.8 (High).
Where can I find more information about this vulnerability?
More information about this vulnerability can be found in the references: [Google Code](https://code.google.com/p/chromium/issues/detail?id=808192), [Chrome Releases](https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html), and [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1552502).
- collector/security-tracker-debian
- agent/type
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/title
- agent/weakness
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-6065
- agent/software-canonical-lookup
- agent/description
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-19-367
- alias/ZDI-CAN-7482
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/references
- agent/softwarecombine
- agent/event
- agent/tags
- collector/nvd-cve
- package-manager/debian
- vendor/google
- canonical/google chrome
- vendor/redhat
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/6.0
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/6.0
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/6.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- vendor/mi
- canonical/mi mi6 browser
- package-manager/redhat
- vendor/xiaomi
- canonical/xiaomi browser
- canonical/google chromium v8