PT-2018-3280 · Google+2 · Google Chrome+2

Rob Wu · Published 2018-04-17 · Updated 2021-09-08 · CVE-2018-6151

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 66.0.3359.117

Description The issue is related to a bad cast in DevTools in Google Chrome, which allowed an attacker to perform an out of bounds memory read via a crafted Chrome Extension. This could be achieved if the attacker convinced a user to install a malicious extension. The vulnerability affects Google Chrome on various operating systems, including Windows, Linux, Mac, and Chrome OS.

Recommendations For versions prior to 66.0.3359.117, update to version 66.0.3359.117 or later to resolve the issue. As a temporary workaround, consider restricting the installation of extensions to trusted sources to minimize the risk of exploitation. Avoid using unverified or suspicious extensions until the issue is resolved.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2018-2278

BDU:2019-04479

CVE-2018-6151

DSA-4256-1

MGASA-2018-0343

RHSA-2018:2282

RHSA-2018_2282

Affected Products

Alt Linux

Google Chrome

Red Hat

References · 21

• 🔥 https://crbug.com/805905 · Exploit
• https://ubuntu.com/security/CVE-2018-6151 · Vendor Advisory
• https://security.gentoo.org/glsa/201808-01 · Vendor Advisory
• https://debian.org/security/2018/dsa-4256 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2282 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4256-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6151 · Security Note
• https://bdu.fstec.ru/vul/2019-04479 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-6151 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0343 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0343.html · Security Note
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-6151 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6151 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=23364 · Note