Red Hat Security Advisory: chromium-browser security update

Fixed packages 2

Vulnerabilities 27

• High 8.8
  CVE-2018-17480 Exploited EPSS 36%

  Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Ch…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018

  KEV Jun 8, 2022
• Unscored —
  CVE-2018-17481

  Incorrect object lifecycle handling in PDFium in Google Chrome prior to 71.0.3578.98 allowed a remote attacker to poten…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18335

  Heap buffer overflow in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit he…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
  Dec 11, 2018
• Unscored —
  CVE-2018-18336

  Incorrect object lifecycle in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially ex…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18337

  Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18338

  Incorrect, thread-unsafe use of SkImage in Canvas in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to p…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18339

  Incorrect object lifecycle in WebAudio in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially …

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18340

  Incorrect object lifecycle in MediaRecorder in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potenti…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18341

  An integer overflow leading to a heap buffer overflow in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote …

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18342

  Execution of user supplied Javascript during object deserialization can update object length leading to an out of bound…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18343

  Incorrect handing of paths leading to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote …

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18344

  Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71…

  chromium chromium-browser Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18345

  Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker who …

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18346

  Incorrect handling of alert box display in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to pr…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18347

  Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18348

  Incorrect handling of bidirectional domain names with RTL characters in Omnibox in Google Chrome prior to 71.0.3578.80 …

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18349

  Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 a…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18350

  Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a remo…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18351

  Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18352

  Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 a…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18353

  Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18354

  Insufficient validate of external protocols in Shell Integration in Google Chrome on Windows prior to 71.0.3578.80 allo…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18355

  Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote at…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18356

  An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a …

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
  Dec 11, 2018
• Unscored —
  CVE-2018-18357

  Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote at…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18358

  Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the loc…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018
• Unscored —
  CVE-2018-18359

  Incorrect handling of Reflect.construct in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to perfo…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Dec 11, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656547
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656548
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656549
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656550
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656551
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656552
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656553
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656554
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656555
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656556
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656557
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656558
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656559
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656560
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656561
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656562
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656563
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656564
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656565
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656566
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656567
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656568
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656569
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656570
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656571
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656572
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656573
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3803.json
• report
  https://access.redhat.com/security/cve/CVE-2018-17480
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-17480
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-17480
• article
  https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• report
  https://access.redhat.com/security/cve/CVE-2018-17481
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-17481
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-17481
• report
  https://access.redhat.com/security/cve/CVE-2018-18335
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-18335