CVE-2018-17463

High · 8.8 CISA KEV

CVSS

8.8

EPSS

84.6%

Published

Nov 14, 2018

CISA due date

Jun 22, 2022

The record

Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Affected packages

Ecosystem	Package	Fixed
Debian:9	chromium-browser	70.0.3538.67-1~deb9u1
Red Hat:rhel_extras:6	chromium-browser	0:70.0.3538.67-1.el6_10
Red Hat:rhel_extras:6	chromium-browser-debuginfo	0:70.0.3538.67-1.el6_10
SUSE:Package Hub 12 SP2	chromium	70.0.3538.102-74.1
Ubuntu:16.04:LTS	chromium-browser	70.0.3538.67-0ubuntu0.16.04.1
Ubuntu:16.04:LTS	oxide-qt	No fix
Ubuntu:18.04:LTS	chromium-browser	70.0.3538.67-0ubuntu0.18.04.1
Ubuntu:Pro:16.04:LTS	oxide-qt	No fix
openSUSE:Tumbleweed	chromium	93.0.4577.82-1.1
openSUSE:Tumbleweed	chromium	113.0.5672.92-1.1

Related vulnerabilities

CVE-2018-6156 Incorect derivation of a packet length in WebRTC in Google Chrome prior to 68.0.3440.75… Also affects chromium-browser
CVE-2018-6126 A precision error in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote… Also affects chromium-browser
CVE-2017-15428 Insufficient data validation in V8 builtins string generator could lead to out of bounds… Also affects chromium-browser
CVE-2018-18356 An integer overflow in path handling lead to a use after free in Skia in Google Chrome… Also affects chromium-browser
CVE-2018-17480 Execution of user supplied Javascript during array deserialization leading to an out of… Also affects chromium-browser
CVE-2018-6065 Integer overflow in computing the required allocation size when instantiating a new… Also affects chromium-browser
CVE-2017-5115 Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote… Also affects chromium-browser
CVE-2017-5116 Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux… Also affects chromium-browser