CVE-2018-6147: Infoleak
A password fields not taking advantage of os protections flaw was found in the Views component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=818133
External References:
https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop58.html
Other sources
Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially sensitive information from process memory via a local process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/chromium-browserto a version that resolves this vulnerability.Fixed in 67.0.3396.62 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 67.0.3396.62
Event History
Frequently Asked Questions
What is the severity of CVE-2018-6147?
CVE-2018-6147 has been assigned a medium severity level due to its potential impact on sensitive data exposure.
How do I fix CVE-2018-6147?
To fix CVE-2018-6147, update the Chromium browser to version 67.0.3396.62 or later.
What type of vulnerability is CVE-2018-6147?
CVE-2018-6147 is a vulnerability related to password fields not utilizing operating system protections.
Which versions of Chromium are affected by CVE-2018-6147?
CVE-2018-6147 affects versions of Chromium prior to 67.0.3396.62.
Is CVE-2018-6147 applicable to macOS users?
CVE-2018-6147 is not applicable to macOS users as it specifically targets versions of the Chromium browser on certain Linux distributions.