PT-2018-2061 · Google+3 · Skia+4

Tran Tien Hung · Published 2018-09-10 · Updated 2024-06-15 · CVE-2018-18343

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 71.0.3578.80

Description The issue is related to the Skia graphics library in Google Chrome, which contains defects in cryptographic algorithms. Exploitation of this issue may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information using a specially crafted HTML page. The vulnerability is caused by incorrect handling of paths, leading to a use after free in Skia, which can potentially exploit heap corruption.

Recommendations For Google Chrome versions prior to 71.0.3578.80, update to version 71.0.3578.80 or later to resolve the issue. As a temporary workaround, consider restricting access to specially crafted HTML pages that could exploit the vulnerability in the Skia graphics library. Avoid using the affected Skia library until the issue is resolved.

Fix

Use After Free

Memory Corruption

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-416

CWE-787

CWE-327

Related Identifiers

ALT-PU-2018-2879

BDU:2019-00011

CVE-2018-18343

DSA-4352-1

OPENSUSE-SU-2018:4143-1

OPENSUSE-SU-2018_4056-1

OPENSUSE-SU-2018_4142-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

RHSA-2018:3803

RHSA-2018_3803

Affected Products

Alt Linux

Google Chrome

Red Hat

Skia

Suse

References · 2332

• https://access.redhat.com/errata/RHSA-2018:3803 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-18343 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18343 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-18343 · Vendor Advisory
• https://debian.org/security/2018/dsa-4352 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10681-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-18343 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00011 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2018:4143-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18343 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-18343 · Security Note
• https://osv.dev/vulnerability/DSA-4352-1 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=57444186 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-18343 · Vendor Advisory