5.4Medium
Google Chrome
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
8.8High
KEV
CVE-2018-6065Google Chromium V8 Integer Overflow Vulnerability
Known exploited — Google Chromium V8 Integer Overflow Vulnerability
CISA confirmed this vulnerability is used in real attacks on 08.06.2022. Remediation deadline for US federal agencies: 22.06.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2018-6065
Description
Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Weakness (CWE):
CWE-190
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| debian | debian linux | 9.0 | |
| Chrome | unspecified – < 65.0.3325.146 | ||
| mi | mi6 browser | — | |
| redhat | enterprise linux desktop | 6.0 | |
| redhat | enterprise linux server | 6.0 | |
| redhat | enterprise linux workstation | 6.0 |
References and patches
- https://crbug.com/808192 ExploitIssue Tracking
- https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html Release NotesVendor Advisory
- 103297 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- RHSA-2018:0484 vendor-advisoryThird Party Advisory
- 44584 exploitExploitThird Party AdvisoryVDB Entry
- DSA-4182 vendor-advisoryMailing ListThird Party Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-19-367/ Third Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6065 US Government Resource
CPE matches (NVD) (6)
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*< 65.0.3325.146cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:a:mi:mi6_browser:-:*:*:*:*:*:*:*