Vulnerability Description
Execution of user supplied Javascript during object deserialization can update object length leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Chrome | < 71.0.3578.80 | |
| Redhat | Enterprise Linux Desktop | 6.0 |
| Redhat | Enterprise Linux Server | 6.0 |
| Redhat | Enterprise Linux Workstation | 6.0 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/106084
- https://access.redhat.com/errata/RHSA-2018:3803
- https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.
- https://crbug.com/906313
- https://security.gentoo.org/glsa/201908-18
- https://www.debian.org/security/2018/dsa-4352
- http://www.securityfocus.com/bid/106084
- https://access.redhat.com/errata/RHSA-2018:3803
- https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.
- https://crbug.com/906313
- https://security.gentoo.org/glsa/201908-18
- https://www.debian.org/security/2018/dsa-4352
FAQ
What is CVE-2018-18342?
CVE-2018-18342 is a vulnerability with a CVSS score of 8.8 (HIGH). Execution of user supplied Javascript during object deserialization can update object length leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to...
How severe is CVE-2018-18342?
CVE-2018-18342 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-18342?
Check the references section above for vendor advisories and patch information. Affected products include: Google Chrome, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation, Debian Debian Linux.