PT-2018-3191 · Google+1 · Google Chrome+1

Publicado 2018-09-04 · Atualizado 2019-10-03 · CVE-2018-16072

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 69.0.3497.81

Description The issue is related to a missing origin check in Blink, allowing a remote attacker to bypass the same origin policy via a crafted HTML page. This could potentially lead to unauthorized access to protected information. The vulnerability is associated with errors in the interaction between Chrome and Android MediaPlayer.

Recommendations For versions prior to 69.0.3497.81, update to version 69.0.3497.81 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted HTML pages to minimize the risk of exploitation.

Exploit

Correção

Origin Validation Error

Enumeração de Fraquezas

CWE-346

Identificadores relacionados

ALT-PU-2018-2292

BDU:2019-04333

CVE-2018-16072

Produtos afetados

Alt Linux

Google Chrome

Referências · 10

• 🔥 https://crbug.com/864283 · Exploit
• https://osv.dev/vulnerability/CVE-2018-16072 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-04333 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-16072 · Nota de Segurança
• http://securityfocus.com/bid/105215 · Nota
• https://ubuntu.com/security/CVE-2018-16072 · Aviso do Fabricante
• https://security.gentoo.org/glsa/201811-10 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-16072 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16072 · Aviso do Fabricante
• https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html · Nota