Vulnerabilities > CVE-2018-6147 - Information Exposure vulnerability in multiple products

047910
CVSS 5.5 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
local
low complexity
google
debian
redhat
CWE-200
nessus

Summary

Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially sensitive information from process memory via a local process.

Vulnerable Configurations

Part Description Count
Application
Google
3871
OS
Apple
1
OS
Debian
1
OS
Redhat
3

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2018-546.NASL
    descriptionThis update for chromium to version 66.0.3359.181 fixes the following issues : The following security issues were fixed (boo#1095163) : - CVE-2018-6123: Use after free in Blink. - CVE-2018-6124: Type confusion in Blink. - CVE-2018-6125: Overly permissive policy in WebUSB. - CVE-2018-6126: Heap buffer overflow in Skia. - CVE-2018-6127: Use after free in indexedDB. - CVE-2018-6128: uXSS in Chrome on iOS. - CVE-2018-6129: Out of bounds memory access in WebRTC. - CVE-2018-6130: Out of bounds memory access in WebRTC. - CVE-2018-6131: Incorrect mutability protection in WebAssembly. - CVE-2018-6132: Use of uninitialized memory in WebRTC. - CVE-2018-6133: URL spoof in Omnibox. - CVE-2018-6134: Referrer Policy bypass in Blink. - CVE-2018-6135: UI spoofing in Blink. - CVE-2018-6136: Out of bounds memory access in V8. - CVE-2018-6137: Leak of visited status of page in Blink. - CVE-2018-6138: Overly permissive policy in Extensions. - CVE-2018-6139: Restrictions bypass in the debugger extension API. - CVE-2018-6140: Restrictions bypass in the debugger extension API. - CVE-2018-6141: Heap buffer overflow in Skia. - CVE-2018-6142: Out of bounds memory access in V8. - CVE-2018-6143: Out of bounds memory access in V8. - CVE-2018-6144: Out of bounds memory access in PDFium. - CVE-2018-6145: Incorrect escaping of MathML in Blink. - CVE-2018-6147: Password fields not taking advantage of OS protections in Views. Additional changes : - Autoplay: Force enable on desktop for Web Audio This update enables the
    last seen2020-06-05
    modified2018-06-01
    plugin id110275
    published2018-06-01
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110275
    titleopenSUSE Security Update : chromium (openSUSE-2018-546)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2018-759.NASL
    descriptionThis update for Chromium to version 67.0.3396.99 fixes multiple issues. Security issues fixed (bsc#1095163) : - CVE-2018-6123: Use after free in Blink - CVE-2018-6124: Type confusion in Blink - CVE-2018-6125: Overly permissive policy in WebUSB - CVE-2018-6126: Heap buffer overflow in Skia - CVE-2018-6127: Use after free in indexedDB - CVE-2018-6129: Out of bounds memory access in WebRTC - CVE-2018-6130: Out of bounds memory access in WebRTC - CVE-2018-6131: Incorrect mutability protection in WebAssembly - CVE-2018-6132: Use of uninitialized memory in WebRTC - CVE-2018-6133: URL spoof in Omnibox - CVE-2018-6134: Referrer Policy bypass in Blink - CVE-2018-6135: UI spoofing in Blink - CVE-2018-6136: Out of bounds memory access in V8 - CVE-2018-6137: Leak of visited status of page in Blink - CVE-2018-6138: Overly permissive policy in Extensions - CVE-2018-6139: Restrictions bypass in the debugger extension API - CVE-2018-6140: Restrictions bypass in the debugger extension API - CVE-2018-6141: Heap buffer overflow in Skia - CVE-2018-6142: Out of bounds memory access in V8 - CVE-2018-6143: Out of bounds memory access in V8 - CVE-2018-6144: Out of bounds memory access in PDFium - CVE-2018-6145: Incorrect escaping of MathML in Blink - CVE-2018-6147: Password fields not taking advantage of OS protections in Views - CVE-2018-6148: Incorrect handling of CSP header (boo#1096508) - CVE-2018-6149: Out of bounds write in V8 (boo#1097452) The following tracked packaging changes are included : - Require ffmpeg >= 4.0 (boo#1095545)
    last seen2020-06-05
    modified2018-07-26
    plugin id111345
    published2018-07-26
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111345
    titleopenSUSE Security Update : Chromium (openSUSE-2018-759)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4237.NASL
    descriptionSeveral vulnerabilities have been discovered in the chromium web browser. - CVE-2018-6118 Ned Williamson discovered a use-after-free issue. - CVE-2018-6120 Zhou Aiting discovered a buffer overflow issue in the pdfium library. - CVE-2018-6121 It was discovered that malicious extensions could escalate privileges. - CVE-2018-6122 A type confusion issue was discovered in the v8 JavaScript library. - CVE-2018-6123 Looben Yang discovered a use-after-free issue. - CVE-2018-6124 Guang Gong discovered a type confusion issue. - CVE-2018-6125 Yubico discovered that the WebUSB implementation was too permissive. - CVE-2018-6126 Ivan Fratric discovered a buffer overflow issue in the skia library. - CVE-2018-6127 Looben Yang discovered a use-after-free issue. - CVE-2018-6129 Natalie Silvanovich discovered an out-of-bounds read issue in WebRTC. - CVE-2018-6130 Natalie Silvanovich discovered an out-of-bounds read issue in WebRTC. - CVE-2018-6131 Natalie Silvanovich discovered an error in WebAssembly. - CVE-2018-6132 Ronald E. Crane discovered an uninitialized memory issue. - CVE-2018-6133 Khalil Zhani discovered a URL spoofing issue. - CVE-2018-6134 Jun Kokatsu discovered a way to bypass the Referrer Policy. - CVE-2018-6135 Jasper Rebane discovered a user interface spoofing issue. - CVE-2018-6136 Peter Wong discovered an out-of-bounds read issue in the v8 JavaScript library. - CVE-2018-6137 Michael Smith discovered an information leak. - CVE-2018-6138 Francois Lajeunesse-Robert discovered that the extensions policy was too permissive. - CVE-2018-6139 Rob Wu discovered a way to bypass restrictions in the debugger extension. - CVE-2018-6140 Rob Wu discovered a way to bypass restrictions in the debugger extension. - CVE-2018-6141 Yangkang discovered a buffer overflow issue in the skia library. - CVE-2018-6142 Choongwoo Han discovered an out-of-bounds read in the v8 JavaScript library. - CVE-2018-6143 Guang Gong discovered an out-of-bounds read in the v8 JavaScript library. - CVE-2018-6144 pdknsk discovered an out-of-bounds read in the pdfium library. - CVE-2018-6145 Masato Kinugawa discovered an error in the MathML implementation. - CVE-2018-6147 Michail Pishchagin discovered an error in password entry fields. - CVE-2018-6148 Michal Bentkowski discovered that the Content Security Policy header was handled incorrectly. - CVE-2018-6149 Yu Zhou and Jundong Xie discovered an out-of-bounds write issue in the v8 JavaScript library.
    last seen2020-06-01
    modified2020-06-02
    plugin id110820
    published2018-07-02
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110820
    titleDebian DSA-4237-1 : chromium-browser - security update
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-09B59B0227.NASL
    descriptionUpdate to Chromium 67. Security fix for CVE-2018-6123 CVE-2018-6124 CVE-2018-6125 CVE-2018-6126 CVE-2018-6127 CVE-2018-6128 CVE-2018-6129 CVE-2018-6130 CVE-2018-6131 CVE-2018-6132 CVE-2018-6133 CVE-2018-6134 CVE-2018-6135 CVE-2018-6136 CVE-2018-6137 CVE-2018-6148 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2018-06-21
    plugin id110625
    published2018-06-21
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110625
    titleFedora 27 : chromium (2018-09b59b0227)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-7C80AAEF26.NASL
    descriptionUpdate to Chromium 67. Security fix for CVE-2018-6123 CVE-2018-6124 CVE-2018-6125 CVE-2018-6126 CVE-2018-6127 CVE-2018-6128 CVE-2018-6129 CVE-2018-6130 CVE-2018-6131 CVE-2018-6132 CVE-2018-6133 CVE-2018-6134 CVE-2018-6135 CVE-2018-6136 CVE-2018-6137 CVE-2018-6148 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2019-01-03
    plugin id120558
    published2019-01-03
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/120558
    titleFedora 28 : chromium (2018-7c80aaef26)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-548.NASL
    descriptionThis update for Chromium to version 67.0.3396.99 fixes multiple issues. Security issues fixed (bsc#1095163) : - CVE-2018-6123: Use after free in Blink - CVE-2018-6124: Type confusion in Blink - CVE-2018-6125: Overly permissive policy in WebUSB - CVE-2018-6126: Heap buffer overflow in Skia - CVE-2018-6127: Use after free in indexedDB - CVE-2018-6129: Out of bounds memory access in WebRTC - CVE-2018-6130: Out of bounds memory access in WebRTC - CVE-2018-6131: Incorrect mutability protection in WebAssembly - CVE-2018-6132: Use of uninitialized memory in WebRTC - CVE-2018-6133: URL spoof in Omnibox - CVE-2018-6134: Referrer Policy bypass in Blink - CVE-2018-6135: UI spoofing in Blink - CVE-2018-6136: Out of bounds memory access in V8 - CVE-2018-6137: Leak of visited status of page in Blink - CVE-2018-6138: Overly permissive policy in Extensions - CVE-2018-6139: Restrictions bypass in the debugger extension API - CVE-2018-6140: Restrictions bypass in the debugger extension API - CVE-2018-6141: Heap buffer overflow in Skia - CVE-2018-6142: Out of bounds memory access in V8 - CVE-2018-6143: Out of bounds memory access in V8 - CVE-2018-6144: Out of bounds memory access in PDFium - CVE-2018-6145: Incorrect escaping of MathML in Blink - CVE-2018-6147: Password fields not taking advantage of OS protections in Views - CVE-2018-6148: Incorrect handling of CSP header (boo#1096508) - CVE-2018-6149: Out of bounds write in V8 (boo#1097452) The following tracked packaging changes are included : - Require ffmpeg >= 4.0 (boo#1095545)
    last seen2020-05-31
    modified2019-03-27
    plugin id123234
    published2019-03-27
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123234
    titleopenSUSE Security Update : Chromium (openSUSE-2019-548)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_427B0F58644C11E89E1BE8E0B747A45A.NASL
    descriptionGoogle Chrome Releases reports : 34 security fixes in this release, including : - [835639] High CVE-2018-6123: Use after free in Blink. Reported by Looben Yang on 2018-04-22 - [840320] High CVE-2018-6124: Type confusion in Blink. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-07 - [818592] High CVE-2018-6125: Overly permissive policy in WebUSB. Reported by Yubico, Inc on 2018-03-05 - [844457] High CVE-2018-6126: Heap buffer overflow in Skia. Reported by Ivan Fratric of Google Project Zero on 2018-05-18 - [842990] High CVE-2018-6127: Use after free in indexedDB. Reported by Looben Yang on 2018-05-15 - [841105] High CVE-2018-6128: uXSS in Chrome on iOS. Reported by Tomasz Bojarski on 2018-05-09 - [838672] High CVE-2018-6129: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-01 - [838402] High CVE-2018-6130: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-04-30 - [826434] High CVE-2018-6131: Incorrect mutability protection in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-27 - [839960] Medium CVE-2018-6132: Use of uninitialized memory in WebRTC. Reported by Ronald E. Crane on 2018-05-04 - [817247] Medium CVE-2018-6133: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-28 - [797465] Medium CVE-2018-6134: Referrer Policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-12-23 - [823353] Medium CVE-2018-6135: UI spoofing in Blink. Reported by Jasper Rebane on 2018-03-19 - [831943] Medium CVE-2018-6136: Out of bounds memory access in V8. Reported by Peter Wong on 2018-04-12 - [835589] Medium CVE-2018-6137: Leak of visited status of page in Blink. Reported by Michael Smith (spinda.net) on 2018-04-21 - [810220] Medium CVE-2018-6138: Overly permissive policy in Extensions. Reported by Francois Lajeunesse-Robert on 2018-02-08 - [805224] Medium CVE-2018-6139: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-24 - [798222] Medium CVE-2018-6140: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-01 - [796107] Medium CVE-2018-6141: Heap buffer overflow in Skia. Reported by Yangkang (@dnpushme) and Wanglu of Qihoo360 Qex Team on 2017-12-19 - [837939] Medium CVE-2018-6142: Out of bounds memory access in V8. Reported by Choongwoo Han of Naver Corporation on 2018-04-28 - [843022] Medium CVE-2018-6143: Out of bounds memory access in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-15 - [828049] Low CVE-2018-6144: Out of bounds memory access in PDFium. Reported by pdknsk on 2018-04-02 - [805924] Low CVE-2018-6145: Incorrect escaping of MathML in Blink. Reported by Masato Kinugawa on 2018-01-25 - [818133] Low CVE-2018-6147: Password fields not taking advantage of OS protections in Views. Reported by Michail Pishchagin (Yandex) on 2018-03-02 - [847542] Various fixes from internal audits, fuzzing and other initiatives
    last seen2020-06-01
    modified2020-06-02
    plugin id110254
    published2018-05-31
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110254
    titleFreeBSD : chromium -- multiple vulnerabilities (427b0f58-644c-11e8-9e1b-e8e0b747a45a)
  • NASL familyWindows
    NASL idGOOGLE_CHROME_67_0_3396_62.NASL
    descriptionThe version of Google Chrome installed on the remote Windows host is prior to 67.0.3396.62. It is, therefore, affected by a multiple unspecified vulnerabilities as noted in Chrome stable channel update release notes for May 29th, 2018. Please refer to the release notes for additional information. Note that Nessus has not attempted to exploit these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id110228
    published2018-05-31
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110228
    titleGoogle Chrome < 67.0.3396.62 Multiple Vulnerabilities
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_GOOGLE_CHROME_67_0_3396_62.NASL
    descriptionThe version of Google Chrome installed on the remote host is prior to 67.0.3396.62. It is, therefore, affected by multiple unspecified vulnerabilities as noted in Chrome stable channel update release notes for May 29th, 2018. Please refer to the release notes for additional information. Note that Nessus has not attempted to exploit these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id110229
    published2018-05-31
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110229
    titleGoogle Chrome < 67.0.3396.62 Multiple Vulnerabilities (macOS)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2018-1815.NASL
    descriptionAn update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Chromium is an open source web browser, powered by WebKit (Blink). This update upgrades Chromium to version 67.0.3396.62. Security Fix(es) : * chromium-browser: Use after free in Blink (CVE-2018-6123) * chromium-browser: Type confusion in Blink (CVE-2018-6124) * chromium-browser: Overly permissive policy in WebUSB (CVE-2018-6125) * chromium-browser: Heap buffer overflow in Skia (CVE-2018-6126) * chromium-browser: Use after free in indexedDB (CVE-2018-6127) * chromium-browser: Out of bounds memory access in WebRTC (CVE-2018-6129) * chromium-browser: Out of bounds memory access in WebRTC (CVE-2018-6130) * chromium-browser: Incorrect mutability protection in WebAssembly (CVE-2018-6131) * chromium-browser: Use of uninitialized memory in WebRTC (CVE-2018-6132) * chromium-browser: URL spoof in Omnibox (CVE-2018-6133) * chromium-browser: Referrer Policy bypass in Blink (CVE-2018-6134) * chromium-browser: UI spoofing in Blink (CVE-2018-6135) * chromium-browser: Out of bounds memory access in V8 (CVE-2018-6136) * chromium-browser: Leak of visited status of page in Blink (CVE-2018-6137) * chromium-browser: Overly permissive policy in Extensions (CVE-2018-6138) * chromium-browser: Restrictions bypass in the debugger extension API (CVE-2018-6139) * chromium-browser: Restrictions bypass in the debugger extension API (CVE-2018-6140) * chromium-browser: Heap buffer overflow in Skia (CVE-2018-6141) * chromium-browser: Out of bounds memory access in V8 (CVE-2018-6142) * chromium-browser: Out of bounds memory access in V8 (CVE-2018-6143) * chromium-browser: Out of bounds memory access in PDFium (CVE-2018-6144) * chromium-browser: Incorrect escaping of MathML in Blink (CVE-2018-6145) * chromium-browser: Password fields not taking advantage of OS protections in Views (CVE-2018-6147) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-05-31
    modified2018-06-08
    plugin id110406
    published2018-06-08
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110406
    titleRHEL 6 : chromium-browser (RHSA-2018:1815)

Redhat

advisories
rhsa
idRHSA-2018:1815
rpms
  • chromium-browser-0:67.0.3396.62-2.el6_9
  • chromium-browser-debuginfo-0:67.0.3396.62-2.el6_9