Vulnerabilities > CVE-2018-6156 - Out-of-bounds Write vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Incorect derivation of a packet length in WebRTC in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_B9C525D9919811E8BEBA080027EF1A23.NASL description Google Chrome Releases reports : 42 security fixes in this release, including : - [850350] High CVE-2018-6153: Stack buffer overflow in Skia. Reported by Zhen Zhou of NSFOCUS Security Team on 2018-06-07 - [848914] High CVE-2018-6154: Heap buffer overflow in WebGL. Reported by Omair on 2018-06-01 - [842265] High CVE-2018-6155: Use after free in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-11 - [841962] High CVE-2018-6156: Heap buffer overflow in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-10 - [840536] High CVE-2018-6157: Type confusion in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-07 - [812667] Medium CVE-2018-6150: Cross origin information disclosure in Service Workers. Reported by Rob Wu on 2018-02-15 - [805905] Medium CVE-2018-6151: Bad cast in DevTools. Reported by Rob Wu on 2018-01-25 - [805445] Medium CVE-2018-6152: Local file write in DevTools. Reported by Rob Wu on 2018-01-24 - [841280] Medium CVE-2018-6158: Use after free in Blink. Reported by Zhe Jin, Luyao Liu from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd on 2018-05-09 - [837275] Medium CVE-2018-6159: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-04-26 - [839822] Medium CVE-2018-6160: URL spoof in Chrome on iOS. Reported by evi1m0 of Bilibili Security Team on 2018-05-04 - [826552] Medium CVE-2018-6161: Same origin policy bypass in WebAudio. Reported by Jun Kokatsu (@shhnjk) on 2018-03-27 - [804123] Medium CVE-2018-6162: Heap buffer overflow in WebGL. Reported by Omair on 2018-01-21 - [849398] Medium CVE-2018-6163: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-06-04 - [848786] Medium CVE-2018-6164: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-06-01 - [847718] Medium CVE-2018-6165: URL spoof in Omnibox. Reported by evi1m0 of Bilibili Security Team on 2018-05-30 - [835554] Medium CVE-2018-6166: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-21 - [833143] Medium CVE-2018-6167: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-15 - [828265] Medium CVE-2018-6168: CORS bypass in Blink. Reported by Gunes Acar and Danny Y. Huang of Princeton University, Frank Li of UC Berkeley on 2018-04-03 - [394518] Medium CVE-2018-6169: Permissions bypass in extension installation. Reported by Sam P on 2014-07-16 - [862059] Medium CVE-2018-6170: Type confusion in PDFium. Reported by Anonymous on 2018-07-10 - [851799] Medium CVE-2018-6171: Use after free in WebBluetooth. Reported by [email protected] on 2018-06-12 - [847242] Medium CVE-2018-6172: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-05-28 - [836885] Medium CVE-2018-6173: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-04-25 - [835299] Medium CVE-2018-6174: Integer overflow in SwiftShader. Reported by Mark Brand of Google Project Zero on 2018-04-20 - [826019] Medium CVE-2018-6175: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-26 - [666824] Medium CVE-2018-6176: Local user privilege escalation in Extensions. Reported by Jann Horn of Google Project Zero on 2016-11-18 - [826187] Low CVE-2018-6177: Cross origin information leak in Blink. Reported by Ron Masas (Imperva) on 2018-03-27 - [823194] Low CVE-2018-6178: UI spoof in Extensions. Reported by Khalil Zhani on 2018-03-19 - [816685] Low CVE-2018-6179: Local file information leak in Extensions. Reported by Anonymous on 2018-02-26 - [797461] Low CVE-2018-6044: Request privilege escalation in Extensions. Reported by Wob Wu on 2017-12-23 - [791324] Low CVE-2018-4117: Cross origin information leak in Blink. Reported by AhsanEjaz - @AhsanEjazA on 2017-12-03 - [866821] Various fixes from internal audits, fuzzing and other initiatives last seen 2020-06-01 modified 2020-06-02 plugin id 111407 published 2018-07-30 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/111407 title FreeBSD : chromium -- multiple vulnerabilities (b9c525d9-9198-11e8-beba-080027ef1a23) NASL family Fedora Local Security Checks NASL id FEDORA_2018-499F2DBC96.NASL description Update to Chromium 68. Security fix for CVE-2018-4117 CVE-2018-6044 CVE-2018-6150 CVE-2018-6151 CVE-2018-6152 CVE-2018-6153 CVE-2018-6154 CVE-2018-6155 CVE-2018-6156 CVE-2018-6157 CVE-2018-6158 CVE-2018-6159 CVE-2018-6161 CVE-2018-6162 CVE-2018-6163 CVE-2018-6149 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2019-01-03 plugin id 120392 published 2019-01-03 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/120392 title Fedora 28 : chromium (2018-499f2dbc96) NASL family SuSE Local Security Checks NASL id OPENSUSE-2019-559.NASL description This update for Chromium to version 68.0.3440.75 fixes multiple issues. Security issues fixed (boo#1102530) : - CVE-2018-6153: Stack-based buffer overflow in Skia - CVE-2018-6154: Heap buffer overflow in WebGL - CVE-2018-6155: Use after free in WebRTC - CVE-2018-6156: Heap buffer overflow in WebRTC - CVE-2018-6157: Type confusion in WebRTC - CVE-2018-6158: Use after free in Blink - CVE-2018-6159: Same origin policy bypass in ServiceWorker - CVE-2018-6161: Same origin policy bypass in WebAudio - CVE-2018-6162: Heap buffer overflow in WebGL - CVE-2018-6163: URL spoof in Omnibox - CVE-2018-6164: Same origin policy bypass in ServiceWorker - CVE-2018-6165: URL spoof in Omnibox - CVE-2018-6166: URL spoof in Omnibox - CVE-2018-6167: URL spoof in Omnibox - CVE-2018-6168: CORS bypass in Blink - CVE-2018-6169: Permissions bypass in extension installation - CVE-2018-6170: Type confusion in PDFium - CVE-2018-6171: Use after free in WebBluetooth - CVE-2018-6172: URL spoof in Omnibox - CVE-2018-6173: URL spoof in Omnibox - CVE-2018-6174: Integer overflow in SwiftShader - CVE-2018-6175: URL spoof in Omnibox - CVE-2018-6176: Local user privilege escalation in Extensions - CVE-2018-6177: Cross origin information leak in Blink - CVE-2018-6178: UI spoof in Extensions - CVE-2018-6179: Local file information leak in Extensions - CVE-2018-6044: Request privilege escalation in Extensions - CVE-2018-4117: Cross origin information leak in Blink The following user interface changes are included : - Chrome will show the last seen 2020-05-31 modified 2019-03-27 plugin id 123240 published 2019-03-27 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/123240 title openSUSE Security Update : Chromium (openSUSE-2019-559) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-4165-1.NASL description Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, bypass security restrictions, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, bypass content security policy (CSP) protections, or execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 130200 published 2019-10-24 reporter Ubuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/130200 title Ubuntu 16.04 LTS / 18.04 LTS / 19.04 / 19.10 : firefox vulnerabilities (USN-4165-1) NASL family Windows NASL id MOZILLA_FIREFOX_70_0.NASL description The version of Firefox installed on the remote Windows host is prior to 70.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-34 advisory, including the following: - Incorrect derivation of a packet length in WebRTC in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (CVE-2018-6156) - In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read. (CVE-2019-15903) - When storing a value in IndexedDB, the value last seen 2020-06-01 modified 2020-06-02 plugin id 130170 published 2019-10-24 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/130170 title Mozilla Firefox < 70.0 Multiple Vulnerabilities NASL family MacOS X Local Security Checks NASL id MACOS_FIREFOX_70_0.NASL description The version of Firefox installed on the remote macOS or Mac OS X host is prior to 70.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-34 advisory, including the following: - Incorrect derivation of a packet length in WebRTC in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (CVE-2018-6156) - In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read. (CVE-2019-15903) - When storing a value in IndexedDB, the value last seen 2020-06-01 modified 2020-06-02 plugin id 130169 published 2019-10-24 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/130169 title Mozilla Firefox < 70.0 Multiple Vulnerabilities NASL family SuSE Local Security Checks NASL id OPENSUSE-2018-780.NASL description This update for Chromium to version 68.0.3440.75 fixes multiple issues. Security issues fixed (boo#1102530) : - CVE-2018-6153: Stack-based buffer overflow in Skia - CVE-2018-6154: Heap buffer overflow in WebGL - CVE-2018-6155: Use after free in WebRTC - CVE-2018-6156: Heap buffer overflow in WebRTC - CVE-2018-6157: Type confusion in WebRTC - CVE-2018-6158: Use after free in Blink - CVE-2018-6159: Same origin policy bypass in ServiceWorker - CVE-2018-6161: Same origin policy bypass in WebAudio - CVE-2018-6162: Heap buffer overflow in WebGL - CVE-2018-6163: URL spoof in Omnibox - CVE-2018-6164: Same origin policy bypass in ServiceWorker - CVE-2018-6165: URL spoof in Omnibox - CVE-2018-6166: URL spoof in Omnibox - CVE-2018-6167: URL spoof in Omnibox - CVE-2018-6168: CORS bypass in Blink - CVE-2018-6169: Permissions bypass in extension installation - CVE-2018-6170: Type confusion in PDFium - CVE-2018-6171: Use after free in WebBluetooth - CVE-2018-6172: URL spoof in Omnibox - CVE-2018-6173: URL spoof in Omnibox - CVE-2018-6174: Integer overflow in SwiftShader - CVE-2018-6175: URL spoof in Omnibox - CVE-2018-6176: Local user privilege escalation in Extensions - CVE-2018-6177: Cross origin information leak in Blink - CVE-2018-6178: UI spoof in Extensions - CVE-2018-6179: Local file information leak in Extensions - CVE-2018-6044: Request privilege escalation in Extensions - CVE-2018-4117: Cross origin information leak in Blink The following user interface changes are included : - Chrome will show the last seen 2020-06-05 modified 2018-07-30 plugin id 111432 published 2018-07-30 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/111432 title openSUSE Security Update : Chromium (openSUSE-2018-780) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2018-2282.NASL description An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Chromium is an open source web browser, powered by WebKit (Blink). This update upgrades Chromium to version 68.0.3440.75. Security Fix(es) : * chromium-browser: Stack buffer overflow in Skia (CVE-2018-6153) * chromium-browser: Heap buffer overflow in WebGL (CVE-2018-6154) * chromium-browser: Use after free in WebRTC (CVE-2018-6155) * chromium-browser: Heap buffer overflow in WebRTC (CVE-2018-6156) * chromium-browser: Type confusion in WebRTC (CVE-2018-6157) * chromium-browser: Cross origin information disclosure in Service Workers (CVE-2018-6150) * chromium-browser: Bad cast in DevTools (CVE-2018-6151) * chromium-browser: Local file write in DevTools (CVE-2018-6152) * chromium-browser: Use after free in Blink (CVE-2018-6158) * chromium-browser: Same origin policy bypass in ServiceWorker (CVE-2018-6159) * chromium-browser: Same origin policy bypass in WebAudio (CVE-2018-6161) * chromium-browser: Heap buffer overflow in WebGL (CVE-2018-6162) * chromium-browser: URL spoof in Omnibox (CVE-2018-6163) * chromium-browser: Same origin policy bypass in ServiceWorker (CVE-2018-6164) * chromium-browser: URL spoof in Omnibox (CVE-2018-6165) * chromium-browser: URL spoof in Omnibox (CVE-2018-6166) * chromium-browser: URL spoof in Omnibox (CVE-2018-6167) * chromium-browser: CORS bypass in Blink (CVE-2018-6168) * chromium-browser: Permissions bypass in extension installation (CVE-2018-6169) * chromium-browser: Type confusion in PDFium (CVE-2018-6170) * chromium-browser: Use after free in WebBluetooth (CVE-2018-6171) * chromium-browser: URL spoof in Omnibox (CVE-2018-6172) * chromium-browser: URL spoof in Omnibox (CVE-2018-6173) * chromium-browser: Integer overflow in SwiftShader (CVE-2018-6174) * chromium-browser: URL spoof in Omnibox (CVE-2018-6175) * chromium-browser: Local user privilege escalation in Extensions (CVE-2018-6176) * chromium-browser: Cross origin information leak in Blink (CVE-2018-4117) * chromium-browser: Request privilege escalation in Extensions (CVE-2018-6044) * chromium-browser: Cross origin information leak in Blink (CVE-2018-6177) * chromium-browser: UI spoof in Extensions (CVE-2018-6178) * chromium-browser: Local file information leak in Extensions (CVE-2018-6179) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. last seen 2020-05-31 modified 2018-08-02 plugin id 111487 published 2018-08-02 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/111487 title RHEL 6 : chromium-browser (RHSA-2018:2282) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201808-01.NASL description The remote host is affected by the vulnerability described in GLSA-201808-01 (Chromium, Google Chrome: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the referenced CVE identifiers and Google Chrome Releases for details. Impact : A remote attacker could escalate privileges, cause a heap buffer overflow, obtain sensitive information or spoof a URL. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 112075 published 2018-08-23 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/112075 title GLSA-201808-01 : Chromium, Google Chrome: Multiple vulnerabilities NASL family Fedora Local Security Checks NASL id FEDORA_2018-4A16E37C81.NASL description Update to Chromium 69. (EPEL-7 update is blocked by a GCC bug: 1629813, so as soon as devtoolset-8 arrives...) Fixes a lot of security issues, like every major release of Chromium, including CVE-2018-16087 CVE-2018-16088 CVE-2018-16086CVE-2018-16065 CVE-2018-16066 CVE-2018-16067 CVE-2018-16068 CVE-2018-16069 CVE-2018-16070 CVE-2018-16071 CVE-2018-16072 CVE-2018-16073 CVE-2018-16074 CVE-2018-16075 CVE-2018-16076 CVE-2018-16077 CVE-2018-16078 ---- Update to Chromium 68. Security fix for CVE-2018-4117 CVE-2018-6044 CVE-2018-6150 CVE-2018-6151 CVE-2018-6152 CVE-2018-6153 CVE-2018-6154 CVE-2018-6155 CVE-2018-6156 CVE-2018-6157 CVE-2018-6158 CVE-2018-6159 CVE-2018-6161 CVE-2018-6162 CVE-2018-6163 CVE-2018-6149 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2018-09-24 plugin id 117647 published 2018-09-24 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/117647 title Fedora 27 : chromium (2018-4a16e37c81) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-4256.NASL description Several vulnerabilities have been discovered in the chromium web browser. - CVE-2018-4117 AhsanEjaz discovered an information leak. - CVE-2018-6044 Rob Wu discovered a way to escalate privileges using extensions. - CVE-2018-6150 Rob Wu discovered an information disclosure issue (this problem was fixed in a previous release but was mistakenly omitted from upstream last seen 2020-06-01 modified 2020-06-02 plugin id 111360 published 2018-07-27 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/111360 title Debian DSA-4256-1 : chromium-browser - security update
Redhat
| rpms |
|