CVE-2018-6142: Medium severity Google Chrome vulnerability

Q: What must an attacker do to exploit this issue?

An attacker must cause a user to open or process a crafted PDF file in an affected Chrome or Chromium browser. No attacker authentication or local privileges are required, but user interaction is required.

Q: What is the impact of successful exploitation?

Successful exploitation can allow an out-of-bounds memory read, potentially exposing confidential information available to the browser process. The available data does not indicate integrity or availability impact.

Q: Which versions should be remediated?

Google Chrome versions earlier than 67.0.3396.62 are affected. The listed Chromium browser packages for Debian and Red Hat should be checked with their vendors to confirm the installed build includes the corresponding fix.

Published May 30, 2018

Updated

An out of bounds memory access flaw was found in the V8 component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=837939

External References:

https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop58.html

Other sources

Array bounds check failure in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.

Affected Software

3 affected componentsFixes available

debian/chromium-browser

redhat/chromium-browser<67.0.3396.62

67.0.3396.62

Google Chrome<67.0.3396.62

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 67.0.3396.62
Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 67.0.3396.62

Event History

May 30, 2018

Data Sourced

via Red Hat·07:57 AM

DescriptionSeverityAffected Software

Jun 27, 2019

CVE Published

via MITRE·04:13 PM

Data Sourced

via MITRE·04:13 PM

DescriptionWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

An attacker must cause a user to open or process a crafted PDF file in an affected Chrome or Chromium browser. No attacker authentication or local privileges are required, but user interaction is required.

What is the impact of successful exploitation?

Successful exploitation can allow an out-of-bounds memory read, potentially exposing confidential information available to the browser process. The available data does not indicate integrity or availability impact.

Which versions should be remediated?

Google Chrome versions earlier than 67.0.3396.62 are affected. The listed Chromium browser packages for Debian and Red Hat should be checked with their vendors to confirm the installed build includes the corresponding fix.

CVE-2018-6142: Medium severity Google Chrome vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

What is the impact of successful exploitation?

Which versions should be remediated?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

What is the impact of successful exploitation?

Which versions should be remediated?