Multiple vulnerabilities in Google Chrome

Beschreibung

Multiple serious vulnerabilities have been found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, bypass security restrictions, spoof user interface, gain privileges, write local files and obtain sensitive information.

Below is a complete list of vulnerabilities:

1. A stack buffer overflow vulnerability in Skia can be exploited remotely to execute arbitrary code and cause denial of service;
2. Multiple heap buffer overflow vulnerabilities in WebGL can be exploited remotely to execute arbitrary code and cause denial of service;
3. A use after free vulnerability in WebRTC can be exploited remotely to execute arbitrary code;
4. A heap buffer overflow vulnerability in WebRTC can be exploited remotely to execute arbitrary code and cause denial of service;
5. A use after free vulnerability in Blink can be exploited remotely to execute arbitrary code;
6. Multiple same origin policy bypass vulnerabilities in ServiceWorker can be exploited remotely to bypass security restrictions;
7. A same origin policy bypass vulnerability in WebAudio can be exploited remotely to bypass security restrictions;
8. Multiple URL spoof vulnerabilities in Omnibox can be exploited remotely to spoof user interface;
9. A CORS bypass vulnerabilities in Blink can be exploited remotely to bypass security restrictions;
10. A permission bypass vulnerability in extension installation can be exploited remotely to bypass security restrictions;
11. A type confusion vulnerability in PDFium can be exploited remotely to execute arbitrary code;
12. A use after free vulnerability in WebBluetooth can be exploited remotely to execute arbitrary code;
13. A integer overflow vulnerability in SwiftShader can be exploited remotely to cause denial of service;
14. An unspecified vulnerability in Extensions can be exploited remotely to gain privileges;
15. Multiple cross origin information leak vulnerabilities in Blink can be exploited remotely to obtain sensitive information;
16. A UI spoof vulnerability in Extensions can be exploited remotely to spoof user interface;
17. A local file information leak vulnerability in Extensions can be exploited remotely to obtain sensitive information;
18. A request privilege escalation vulnerability in Extensions can be exploited remotely to gain privileges;
19. A cross origin information disclosure in Service Workers can be exploited remotely to obtain sensitive information;
20. A local file write in DevTools can be exploited locally to write local files.

Ursprüngliche Informationshinweise

• Stable Channel Update for Desktop

CVE Liste

• CVE-2018-4117
  critical
• CVE-2018-6169
  critical
• CVE-2018-6170
  critical
• CVE-2018-6171
  critical
• CVE-2018-6172
  critical
• CVE-2018-6173
  critical
• CVE-2018-6174
  critical
• CVE-2018-6175
  critical
• CVE-2018-6176
  critical
• CVE-2018-6177
  critical
• CVE-2018-6178
  critical
• CVE-2018-6179
  critical
• CVE-2018-6044
  critical
• CVE-2018-6150
  critical
• CVE-2018-6151
  critical
• CVE-2018-6152
  critical
• CVE-2018-6153
  critical
• CVE-2018-6154
  critical
• CVE-2018-6155
  critical
• CVE-2018-6156
  critical
• CVE-2018-6157
  critical
• CVE-2018-6158
  critical
• CVE-2018-6159
  critical
• CVE-2018-6161
  critical
• CVE-2018-6162
  critical
• CVE-2018-6163
  critical
• CVE-2018-6164
  critical
• CVE-2018-6165
  critical
• CVE-2018-6166
  critical
• CVE-2018-6167
  critical
• CVE-2018-6168
  critical

Mehr erfahren

Informieren Sie sich über die Statistiken der in Ihrer Region verbreiteten Sicherheitslücken statistics.securelist.com