var-201804-1177
Vulnerability from variot
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. watchOS before 4.3 is affected. The issue involves the fetch API in the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. Apple iOS, iCloud for Windows, iTunes for Windows, Safari, and tvOS are all products of the American company Apple (Apple). Apple iOS is an operating system developed for mobile devices; Safari is a web browser that comes with the Mac OS X and iOS operating systems by default. WebKit is an open source web browser engine developed by the KDE community and is currently used by browsers such as Apple Safari and Google Chrome.
Background
WebKitGTK+ is a full-featured port of the WebKit rendering engine, suitable for projects requiring any kind of web integration, from hybrid HTML/CSS applications to full-fledged web browsers. ------------------------------------------------------------------------ WebKitGTK+ Security Advisory WSA-2018-0003
Date reported : April 04, 2018 Advisory ID : WSA-2018-0003 Advisory URL : https://webkitgtk.org/security/WSA-2018-0003.html CVE identifiers : CVE-2018-4101, CVE-2018-4113, CVE-2018-4114, CVE-2018-4117, CVE-2018-4118, CVE-2018-4119, CVE-2018-4120, CVE-2018-4122, CVE-2018-4125, CVE-2018-4127, CVE-2018-4128, CVE-2018-4129, CVE-2018-4133, CVE-2018-4146, CVE-2018-4161, CVE-2018-4162, CVE-2018-4163, CVE-2018-4165.
Several vulnerabilities were discovered in WebKitGTK+. Credit to Yuan Deng of Ant-financial Light-Year Security Lab. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. Credit to OSS-Fuzz. Impact: Unexpected interaction with indexing types causing an ASSERT failure. Description: An array indexing issue existed in the handling of a function in JavaScriptCore. This issue was addressed through improved checks. Credit to OSS-Fuzz. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. Credit to an anonymous researcher. Impact: A malicious website may exfiltrate data cross-origin. This was addressed through improved input validation. Credit to Jun Kokatsu (@shhnjk). Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. Credit to an anonymous researcher working with Trend Microys Zero Day Initiative. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. Credit to Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan Team. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. Credit to WanderingGlitch of Trend Micro's Zero Day Initiative. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. Credit to WanderingGlitch of Trend Micro's Zero Day Initiative. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. Credit to an anonymous researcher working with Trend Microys Zero Day Initiative. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. Credit to Zach Markley. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. Credit to likemeng of Baidu Security Lab working with Trend Micro's Zero Day Initiative. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. Credit to Anton Lopanitsyn of Wallarm, Linus Sarud of Detectify (detectify.com), Yuji Tounai of NTT Communications Corporation. Impact: Visiting a maliciously crafted website may lead to a cross- site scripting attack. Description: A cross-site scripting issue existed in WebKit. This issue was addressed with improved URL validation. Credit to OSS-Fuzz. Impact: Processing maliciously crafted web content may lead to a denial of service. Description: A memory corruption issue was addressed through improved input validation. Credit to WanderingGlitch of Trend Micro's Zero Day Initiative. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. Credit to WanderingGlitch of Trend Micro's Zero Day Initiative. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. Credit to WanderingGlitch of Trend Micro's Zero Day Initiative. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. Credit to Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan Team. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling.
We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases.
Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html
The WebKitGTK+ team, April 04, 2018 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
APPLE-SA-2018-3-29-1 iOS 11.3
iOS 11.3 is now available and addresses the following:
Clock Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A person with physical access to an iOS device may be able to see the email address used for iTunes Description: An information disclosure issue existed in the handling of alarms and timers. CVE-2018-4123: Zaheen Hafzar M M (@zaheenhafzer)
CoreFoundation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to gain elevated privileges Description: A race condition was addressed with additional validation. CVE-2018-4155: Samuel GroA (@5aelo) CVE-2018-4158: Samuel GroA (@5aelo)
CoreText Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted string may lead to a denial of service Description: A denial of service issue was addressed through improved memory handling. CVE-2018-4142: Robin Leroy of Google Switzerland GmbH
File System Events Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to gain elevated privileges Description: A race condition was addressed with additional validation. CVE-2018-4167: Samuel GroA (@5aelo)
Files Widget Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: File Widget may display contents on a locked device Description: The File Widget was displaying cached data when in the locked state. CVE-2018-4168: Brandon Moore
Find My iPhone Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A person with physical access to the device may be able to disable Find My iPhone without entering an iCloud password Description: A state management issue existed when restoring from a back up. CVE-2018-4172: Viljami VastamA$?ki
iCloud Drive Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to gain elevated privileges Description: A race condition was addressed with additional validation. CVE-2018-4151: Samuel GroA (@5aelo)
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4150: an anonymous researcher
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2018-4104: The UK's National Cyber Security Centre (NCSC)
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4143: derrek (@derrekr6)
Mail Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged network position may be able to intercept the contents of S/MIME-encrypted e-mail Description: An inconsistent user interface issue was addressed with improved state management. CVE-2018-4174: an anonymous researcher, an anonymous researcher
NSURLSession Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to gain elevated privileges Description: A race condition was addressed with additional validation. CVE-2018-4166: Samuel GroA (@5aelo)
PluginKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to gain elevated privileges Description: A race condition was addressed with additional validation. CVE-2018-4156: Samuel GroA (@5aelo)
Quick Look Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to gain elevated privileges Description: A race condition was addressed with additional validation. CVE-2018-4157: Samuel GroA (@5aelo)
Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website by clicking a link may lead to user interface spoofing Description: An inconsistent user interface issue was addressed with improved state management. CVE-2018-4134: xisigr of Tencent's Xuanwu Lab (tencent.com), Zhiyang Zeng (@Wester) of Tencent Security Platform Department
Safari Login AutoFill Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious website may be able to exfiltrate autofilled data in Safari without explicit user interaction. Description: Safari autofill did not require explicit user interaction before taking place. CVE-2018-4137:
SafariViewController Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to user interface spoofing Description: A state management issue was addressed by disabling text input until the destination page loads. CVE-2018-4149: Abhinash Jain (@abhinashjain)
Security Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A buffer overflow was addressed with improved size validation. CVE-2018-4144: Abraham Masri (@cheesecakeufo)
Storage Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to gain elevated privileges Description: A race condition was addressed with additional validation. CVE-2018-4154: Samuel GroA (@5aelo)
System Preferences Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A configuration profile may incorrectly remain in effect after removal Description: An issue existed in CFPreferences. CVE-2018-4115: Johann Thalakada, Vladimir Zubkov, and Matt Vlasach of Wandera
Telephony Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A remote attacker can cause a device to unexpectedly restart Description: A null pointer dereference issue existed when handling Class 0 SMS messages. CVE-2018-4140: @mjonsson, Arjan van der Oest of Voiceworks BV
Web App Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Cookies may unexpectedly persist in web app Description: A cookie management issue was addressed through improved state management. CVE-2018-4110: Ben Compton and Jason Colley of Cerner Corporation
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4146: found by OSS-Fuzz
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious website may exfiltrate data cross-origin Description: A cross-origin issue existed with the fetch API. CVE-2018-4117: an anonymous researcher, an anonymous researcher
WindowServer Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An unprivileged application may be able to log keystrokes entered into other applications even when secure input mode is enabled Description: By scanning key states, an unprivileged application could log keystrokes entered into other applications even when secure input mode was enabled. CVE-2018-4131: Andreas Hegenberg of folivora.AI GmbH
Additional recognition
WebKit We would like to acknowledge Johnny Nipper of Tinder Security Team for their assistance.
Installation note:
This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
- Navigate to Settings
- Select General
- Select About.
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlq9GlopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbhLRAA to9k0U/CI3PfYp2o2lluS7LgE3jvA7+pXvdjbvoh14BFHf9Wv+yhdtyLQEDSne+0 TM8BkiMgEmo+uKKcVFCDeV9GrkWqO7ocBfT65hj4A/vxPAS6xlBTV9mjZXiqvSWs +Cbb4Nd53o6m2QRORkjNVZ2h0ow53J5RirnyzjWt4LMdCpc4jMG87OCuQheKzjxq g6gOlwblVrRxH6aMX5if/SetGGxzZeY5sKwe1Xhz6yIYsm1Gw45REt3FJs4KEh5Z oL+yWVvaGLOPDzC+DBX0dXJmsqLx9wzDJsqQ2J6Mb/nh1Tgh6NDdHkDCAZ7P6CeU 0IpXK7aaPkRy5GUbkAdzdPEFql9e0/jGlqMf/rZlNTItbgtn0+9e2zsJ0UPPRcWi +7IQygkXnXmYUZ0wrh/Wdye/jAJZpLdsUuWr1RalTdmDASU/tzgpoglf3EyTQoRy IqFGRSe6+no8Pw1qCLUvZz8C6dTKvE+Jv5oe9XbCEjsvpRmQZK64FiQ0HIaAMHKo Rl9OY6+evzyqdAtivE4AFCRT7Z15pktFYAVefWkdVFbVU2mCYF+peXIq6tGg4o+g 70E29XaDZBakcVho9bW4e2rDA+m606ILuZ4AyjEEvfRYH+d+WTvDqdIywq0V7grj qlU787sRw/tVx646jcHVqbYZEgZVmeAvcT8C2c0Zhvo= =RJi8 -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
Debian Security Advisory DSA-4256-1 security@debian.org https://www.debian.org/security/ Michael Gilbert July 26, 2018 https://www.debian.org/security/faq
Package : chromium-browser CVE ID : CVE-2018-4117 CVE-2018-6044 CVE-2018-6150 CVE-2018-6151 CVE-2018-6152 CVE-2018-6153 CVE-2018-6154 CVE-2018-6155 CVE-2018-6156 CVE-2018-6157 CVE-2018-6158 CVE-2018-6159 CVE-2018-6161 CVE-2018-6162 CVE-2018-6163 CVE-2018-6164 CVE-2018-6165 CVE-2018-6166 CVE-2018-6167 CVE-2018-6168 CVE-2018-6169 CVE-2018-6170 CVE-2018-6171 CVE-2018-6172 CVE-2018-6173 CVE-2018-6174 CVE-2018-6175 CVE-2018-6176 CVE-2018-6177 CVE-2018-6178 CVE-2018-6179
Several vulnerabilities have been discovered in the chromium web browser.
CVE-2018-6044
Rob Wu discovered a way to escalate privileges using extensions.
CVE-2018-6150
Rob Wu discovered an information disclosure issue (this problem was
fixed in a previous release but was mistakenly omitted from upstream's
announcement at the time).
CVE-2018-6151
Rob Wu discovered an issue in the developer tools (this problem was
fixed in a previous release but was mistakenly omitted from upstream's
announcement at the time).
CVE-2018-6152
Rob Wu discovered an issue in the developer tools (this problem was
fixed in a previous release but was mistakenly omitted from upstream's
announcement at the time).
CVE-2018-6153
Zhen Zhou discovered a buffer overflow issue in the skia library.
CVE-2018-6158
Zhe Jin discovered a use-after-free issue.
CVE-2018-6159
Jun Kokatsu discovered a way to bypass the same origin policy.
CVE-2018-6161
Jun Kokatsu discovered a way to bypass the same origin policy.
CVE-2018-6164
Jun Kokatsu discovered a way to bypass the same origin policy.
CVE-2018-6168
Gunes Acar and Danny Y. Huang discovered a way to bypass the Cross
Origin Resource Sharing policy.
CVE-2018-6169
Sam P discovered a way to bypass permissions when installing
extensions.
CVE-2018-6174
Mark Brand discovered an integer overflow issue in the swiftshader
library.
CVE-2018-6176
Jann Horn discovered a way to escalate privileges using extensions.
CVE-2018-6177
Ron Masas discovered an information leak.
CVE-2018-6178
Khalil Zhani discovered a user interface spoofing issue.
CVE-2018-6179
It was discovered that information about files local to the system
could be leaked to extensions.
This version also fixes a regression introduced in the previous security update that could prevent decoding of particular audio/video codecs.
We recommend that you upgrade your chromium-browser packages. ========================================================================== Ubuntu Security Notice USN-3635-1 April 30, 2018
webkit2gtk vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in WebKitGTK+.
Software Description: - webkit2gtk: Web content engine library for GTK+
Details:
A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines.
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 17.10: libjavascriptcoregtk-4.0-18 2.20.1-0ubuntu0.17.10.1 libwebkit2gtk-4.0-37 2.20.1-0ubuntu0.17.10.1
Ubuntu 16.04 LTS: libjavascriptcoregtk-4.0-18 2.20.1-0ubuntu0.16.04.1 libwebkit2gtk-4.0-37 2.20.1-0ubuntu0.16.04.1
This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any applications that use WebKitGTK+, such as Epiphany, to make all the necessary changes. Summary:
An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
- Description:
Chromium is an open-source web browser, powered by WebKit (Blink).
Security Fix(es):
-
chromium-browser: Stack buffer overflow in Skia (CVE-2018-6153)
-
chromium-browser: Heap buffer overflow in WebGL (CVE-2018-6154)
-
chromium-browser: Use after free in WebRTC (CVE-2018-6155)
-
chromium-browser: Heap buffer overflow in WebRTC (CVE-2018-6156)
-
chromium-browser: Type confusion in WebRTC (CVE-2018-6157)
-
chromium-browser: Cross origin information disclosure in Service Workers (CVE-2018-6150)
-
chromium-browser: Bad cast in DevTools (CVE-2018-6151)
-
chromium-browser: Local file write in DevTools (CVE-2018-6152)
-
chromium-browser: Use after free in Blink (CVE-2018-6158)
-
chromium-browser: Same origin policy bypass in ServiceWorker (CVE-2018-6159)
-
chromium-browser: Same origin policy bypass in WebAudio (CVE-2018-6161)
-
chromium-browser: Heap buffer overflow in WebGL (CVE-2018-6162)
-
chromium-browser: URL spoof in Omnibox (CVE-2018-6163)
-
chromium-browser: Same origin policy bypass in ServiceWorker (CVE-2018-6164)
-
chromium-browser: URL spoof in Omnibox (CVE-2018-6165)
-
chromium-browser: URL spoof in Omnibox (CVE-2018-6166)
-
chromium-browser: URL spoof in Omnibox (CVE-2018-6167)
-
chromium-browser: CORS bypass in Blink (CVE-2018-6168)
-
chromium-browser: Permissions bypass in extension installation (CVE-2018-6169)
-
chromium-browser: Type confusion in PDFium (CVE-2018-6170)
-
chromium-browser: Use after free in WebBluetooth (CVE-2018-6171)
-
chromium-browser: URL spoof in Omnibox (CVE-2018-6172)
-
chromium-browser: URL spoof in Omnibox (CVE-2018-6173)
-
chromium-browser: Integer overflow in SwiftShader (CVE-2018-6174)
-
chromium-browser: URL spoof in Omnibox (CVE-2018-6175)
-
chromium-browser: Local user privilege escalation in Extensions (CVE-2018-6176)
-
chromium-browser: Cross origin information leak in Blink (CVE-2018-4117)
-
chromium-browser: Request privilege escalation in Extensions (CVE-2018-6044)
-
chromium-browser: Cross origin information leak in Blink (CVE-2018-6177)
-
chromium-browser: UI spoof in Extensions (CVE-2018-6178)
-
chromium-browser: Local file information leak in Extensions (CVE-2018-6179)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the update, Chromium must be restarted for the changes to take effect.
- Bugs fixed (https://bugzilla.redhat.com/):
1608177 - CVE-2018-6153 chromium-browser: Stack buffer overflow in Skia 1608178 - CVE-2018-6154 chromium-browser: Heap buffer overflow in WebGL 1608179 - CVE-2018-6155 chromium-browser: Use after free in WebRTC 1608180 - CVE-2018-6156 chromium-browser: Heap buffer overflow in WebRTC 1608181 - CVE-2018-6157 chromium-browser: Type confusion in WebRTC 1608182 - CVE-2018-6158 chromium-browser: Use after free in Blink 1608183 - CVE-2018-6159 chromium-browser: Same origin policy bypass in ServiceWorker 1608185 - CVE-2018-6161 chromium-browser: Same origin policy bypass in WebAudio 1608186 - CVE-2018-6162 chromium-browser: Heap buffer overflow in WebGL 1608187 - CVE-2018-6163 chromium-browser: URL spoof in Omnibox 1608188 - CVE-2018-6164 chromium-browser: Same origin policy bypass in ServiceWorker 1608189 - CVE-2018-6165 chromium-browser: URL spoof in Omnibox 1608190 - CVE-2018-6166 chromium-browser: URL spoof in Omnibox 1608191 - CVE-2018-6167 chromium-browser: URL spoof in Omnibox 1608192 - CVE-2018-6168 chromium-browser: CORS bypass in Blink 1608193 - CVE-2018-6169 chromium-browser: Permissions bypass in extension installation 1608194 - CVE-2018-6170 chromium-browser: Type confusion in PDFium 1608195 - CVE-2018-6171 chromium-browser: Use after free in WebBluetooth 1608196 - CVE-2018-6172 chromium-browser: URL spoof in Omnibox 1608197 - CVE-2018-6173 chromium-browser: URL spoof in Omnibox 1608198 - CVE-2018-6174 chromium-browser: Integer overflow in SwiftShader 1608199 - CVE-2018-6175 chromium-browser: URL spoof in Omnibox 1608200 - CVE-2018-6176 chromium-browser: Local user privilege escalation in Extensions 1608201 - CVE-2018-6177 chromium-browser: Cross origin information leak in Blink 1608202 - CVE-2018-6178 chromium-browser: UI spoof in Extensions 1608203 - CVE-2018-6179 chromium-browser: Local file information leak in Extensions 1608204 - CVE-2018-6044 chromium-browser: Request privilege escalation in Extensions 1608205 - CVE-2018-4117 chromium-browser: Cross origin information leak in Blink 1608206 - CVE-2018-6150 chromium-browser: Cross origin information disclosure in Service Workers 1608207 - CVE-2018-6151 chromium-browser: Bad cast in DevTools 1608208 - CVE-2018-6152 chromium-browser: Local file write in DevTools
- Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386: chromium-browser-68.0.3440.75-1.el6_10.i686.rpm chromium-browser-debuginfo-68.0.3440.75-1.el6_10.i686.rpm
x86_64: chromium-browser-68.0.3440.75-1.el6_10.x86_64.rpm chromium-browser-debuginfo-68.0.3440.75-1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386: chromium-browser-68.0.3440.75-1.el6_10.i686.rpm chromium-browser-debuginfo-68.0.3440.75-1.el6_10.i686.rpm
x86_64: chromium-browser-68.0.3440.75-1.el6_10.x86_64.rpm chromium-browser-debuginfo-68.0.3440.75-1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386: chromium-browser-68.0.3440.75-1.el6_10.i686.rpm chromium-browser-debuginfo-68.0.3440.75-1.el6_10.i686.rpm
x86_64: chromium-browser-68.0.3440.75-1.el6_10.x86_64.rpm chromium-browser-debuginfo-68.0.3440.75-1.el6_10.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2018-4117 https://access.redhat.com/security/cve/CVE-2018-6044 https://access.redhat.com/security/cve/CVE-2018-6150 https://access.redhat.com/security/cve/CVE-2018-6151 https://access.redhat.com/security/cve/CVE-2018-6152 https://access.redhat.com/security/cve/CVE-2018-6153 https://access.redhat.com/security/cve/CVE-2018-6154 https://access.redhat.com/security/cve/CVE-2018-6155 https://access.redhat.com/security/cve/CVE-2018-6156 https://access.redhat.com/security/cve/CVE-2018-6157 https://access.redhat.com/security/cve/CVE-2018-6158 https://access.redhat.com/security/cve/CVE-2018-6159 https://access.redhat.com/security/cve/CVE-2018-6161 https://access.redhat.com/security/cve/CVE-2018-6162 https://access.redhat.com/security/cve/CVE-2018-6163 https://access.redhat.com/security/cve/CVE-2018-6164 https://access.redhat.com/security/cve/CVE-2018-6165 https://access.redhat.com/security/cve/CVE-2018-6166 https://access.redhat.com/security/cve/CVE-2018-6167 https://access.redhat.com/security/cve/CVE-2018-6168 https://access.redhat.com/security/cve/CVE-2018-6169 https://access.redhat.com/security/cve/CVE-2018-6170 https://access.redhat.com/security/cve/CVE-2018-6171 https://access.redhat.com/security/cve/CVE-2018-6172 https://access.redhat.com/security/cve/CVE-2018-6173 https://access.redhat.com/security/cve/CVE-2018-6174 https://access.redhat.com/security/cve/CVE-2018-6175 https://access.redhat.com/security/cve/CVE-2018-6176 https://access.redhat.com/security/cve/CVE-2018-6177 https://access.redhat.com/security/cve/CVE-2018-6178 https://access.redhat.com/security/cve/CVE-2018-6179 https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201808-01
https://security.gentoo.org/
Severity: Normal Title: Chromium, Google Chrome: Multiple vulnerabilities Date: August 22, 2018 Bugs: #657376, #662436 ID: 201808-01
Synopsis
Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which allows remote attackers to escalate privileges.
Background
Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.
Google Chrome is one fast, simple, and secure browser for all your devices.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-client/chromium < 68.0.3440.75 >= 68.0.3440.75 2 www-client/google-chrome < 68.0.3440.75 >= 68.0.3440.75 ------------------------------------------------------------------- 2 affected packages
Description
Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the referenced CVE identifiers and Google Chrome Releases for details.
Workaround
There is no known workaround at this time.
Resolution
All Chromium users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot -v ">=www-client/chromium-68.0.3440.75"
All Google Chrome users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot -v ">=www-client/google-chrome-68.0.3440.75"
References
[ 1 ] CVE-2018-4117 https://nvd.nist.gov/vuln/detail/CVE-2018-4117 [ 2 ] CVE-2018-6044 https://nvd.nist.gov/vuln/detail/CVE-2018-6044 [ 3 ] CVE-2018-6150 https://nvd.nist.gov/vuln/detail/CVE-2018-6150 [ 4 ] CVE-2018-6151 https://nvd.nist.gov/vuln/detail/CVE-2018-6151 [ 5 ] CVE-2018-6152 https://nvd.nist.gov/vuln/detail/CVE-2018-6152 [ 6 ] CVE-2018-6153 https://nvd.nist.gov/vuln/detail/CVE-2018-6153 [ 7 ] CVE-2018-6154 https://nvd.nist.gov/vuln/detail/CVE-2018-6154 [ 8 ] CVE-2018-6155 https://nvd.nist.gov/vuln/detail/CVE-2018-6155 [ 9 ] CVE-2018-6156 https://nvd.nist.gov/vuln/detail/CVE-2018-6156 [ 10 ] CVE-2018-6157 https://nvd.nist.gov/vuln/detail/CVE-2018-6157 [ 11 ] CVE-2018-6158 https://nvd.nist.gov/vuln/detail/CVE-2018-6158 [ 12 ] CVE-2018-6159 https://nvd.nist.gov/vuln/detail/CVE-2018-6159 [ 13 ] CVE-2018-6160 https://nvd.nist.gov/vuln/detail/CVE-2018-6160 [ 14 ] CVE-2018-6161 https://nvd.nist.gov/vuln/detail/CVE-2018-6161 [ 15 ] CVE-2018-6162 https://nvd.nist.gov/vuln/detail/CVE-2018-6162 [ 16 ] CVE-2018-6163 https://nvd.nist.gov/vuln/detail/CVE-2018-6163 [ 17 ] CVE-2018-6164 https://nvd.nist.gov/vuln/detail/CVE-2018-6164 [ 18 ] CVE-2018-6165 https://nvd.nist.gov/vuln/detail/CVE-2018-6165 [ 19 ] CVE-2018-6166 https://nvd.nist.gov/vuln/detail/CVE-2018-6166 [ 20 ] CVE-2018-6167 https://nvd.nist.gov/vuln/detail/CVE-2018-6167 [ 21 ] CVE-2018-6168 https://nvd.nist.gov/vuln/detail/CVE-2018-6168 [ 22 ] CVE-2018-6169 https://nvd.nist.gov/vuln/detail/CVE-2018-6169 [ 23 ] CVE-2018-6170 https://nvd.nist.gov/vuln/detail/CVE-2018-6170 [ 24 ] CVE-2018-6171 https://nvd.nist.gov/vuln/detail/CVE-2018-6171 [ 25 ] CVE-2018-6172 https://nvd.nist.gov/vuln/detail/CVE-2018-6172 [ 26 ] CVE-2018-6173 https://nvd.nist.gov/vuln/detail/CVE-2018-6173 [ 27 ] CVE-2018-6174 https://nvd.nist.gov/vuln/detail/CVE-2018-6174 [ 28 ] CVE-2018-6175 https://nvd.nist.gov/vuln/detail/CVE-2018-6175 [ 29 ] CVE-2018-6176 https://nvd.nist.gov/vuln/detail/CVE-2018-6176 [ 30 ] CVE-2018-6177 https://nvd.nist.gov/vuln/detail/CVE-2018-6177 [ 31 ] CVE-2018-6178 https://nvd.nist.gov/vuln/detail/CVE-2018-6178 [ 32 ] CVE-2018-6179 https://nvd.nist.gov/vuln/detail/CVE-2018-6179 [ 33 ] CVE-2108-6150 https://nvd.nist.gov/vuln/detail/CVE-2108-6150 [ 34 ] Google Chrome 68.0.3440.75 release announcement
https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/201808-01
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2018 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201804-1177",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "watchos",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "4.3"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "6.0"
},
{
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "6.0"
},
{
"model": "enterprise linux server",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "6.0"
},
{
"model": "safari",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "11.1"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "17.10"
},
{
"model": "webkitgtk\\+",
"scope": "lt",
"trust": 1.0,
"vendor": "webkitgtk",
"version": "2.20.4"
},
{
"model": "icloud",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "7.4"
},
{
"model": "itunes",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "12.7.4"
},
{
"model": "iphone os",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "11.3"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "9.0"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "16.04"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.0.0b2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": null
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.0.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.0.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.0.0b1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.0.2"
}
],
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201804-188"
},
{
"db": "NVD",
"id": "CVE-2018-4117"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple",
"sources": [
{
"db": "PACKETSTORM",
"id": "146964"
},
{
"db": "PACKETSTORM",
"id": "146970"
},
{
"db": "PACKETSTORM",
"id": "146971"
}
],
"trust": 0.3
},
"cve": "CVE-2018-4117",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2018-4117",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.1,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-134148",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2018-4117",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-4117",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201804-188",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-134148",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2018-4117",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-134148"
},
{
"db": "VULMON",
"id": "CVE-2018-4117"
},
{
"db": "CNNVD",
"id": "CNNVD-201804-188"
},
{
"db": "NVD",
"id": "CVE-2018-4117"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. watchOS before 4.3 is affected. The issue involves the fetch API in the \"WebKit\" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. Apple iOS, iCloud for Windows, iTunes for Windows, Safari, and tvOS are all products of the American company Apple (Apple). Apple iOS is an operating system developed for mobile devices; Safari is a web browser that comes with the Mac OS X and iOS operating systems by default. WebKit is an open source web browser engine developed by the KDE community and is currently used by browsers such as Apple Safari and Google Chrome. \n\nBackground\n==========\n\nWebKitGTK+ is a full-featured port of the WebKit rendering engine,\nsuitable for projects requiring any kind of web integration, from\nhybrid HTML/CSS applications to full-fledged web browsers. ------------------------------------------------------------------------\nWebKitGTK+ Security Advisory WSA-2018-0003\n------------------------------------------------------------------------\n\nDate reported : April 04, 2018\nAdvisory ID : WSA-2018-0003\nAdvisory URL : https://webkitgtk.org/security/WSA-2018-0003.html\nCVE identifiers : CVE-2018-4101, CVE-2018-4113, CVE-2018-4114,\n CVE-2018-4117, CVE-2018-4118, CVE-2018-4119,\n CVE-2018-4120, CVE-2018-4122, CVE-2018-4125,\n CVE-2018-4127, CVE-2018-4128, CVE-2018-4129,\n CVE-2018-4133, CVE-2018-4146, CVE-2018-4161,\n CVE-2018-4162, CVE-2018-4163, CVE-2018-4165. \n\nSeveral vulnerabilities were discovered in WebKitGTK+. \n Credit to Yuan Deng of Ant-financial Light-Year Security Lab. \n Impact: Processing maliciously crafted web content may lead to\n arbitrary code execution. Description: Multiple memory corruption\n issues were addressed with improved memory handling. \n Credit to OSS-Fuzz. \n Impact: Unexpected interaction with indexing types causing an ASSERT\n failure. Description: An array indexing issue existed in the\n handling of a function in JavaScriptCore. This issue was addressed\n through improved checks. \n Credit to OSS-Fuzz. \n Impact: Processing maliciously crafted web content may lead to\n arbitrary code execution. Description: Multiple memory corruption\n issues were addressed with improved memory handling. \n Credit to an anonymous researcher. \n Impact: A malicious website may exfiltrate data cross-origin. This\n was addressed through improved input validation. \n Credit to Jun Kokatsu (@shhnjk). \n Impact: Processing maliciously crafted web content may lead to\n arbitrary code execution. Description: Multiple memory corruption\n issues were addressed with improved memory handling. \n Credit to an anonymous researcher working with Trend Microys Zero\n Day Initiative. \n Impact: Processing maliciously crafted web content may lead to\n arbitrary code execution. Description: Multiple memory corruption\n issues were addressed with improved memory handling. \n Credit to Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan Team. \n Impact: Processing maliciously crafted web content may lead to\n arbitrary code execution. Description: Multiple memory corruption\n issues were addressed with improved memory handling. \n Credit to WanderingGlitch of Trend Micro\u0027s Zero Day Initiative. \n Impact: Processing maliciously crafted web content may lead to\n arbitrary code execution. Description: Multiple memory corruption\n issues were addressed with improved memory handling. \n Credit to WanderingGlitch of Trend Micro\u0027s Zero Day Initiative. \n Impact: Processing maliciously crafted web content may lead to\n arbitrary code execution. Description: Multiple memory corruption\n issues were addressed with improved memory handling. \n Credit to an anonymous researcher working with Trend Microys Zero\n Day Initiative. \n Impact: Processing maliciously crafted web content may lead to\n arbitrary code execution. Description: Multiple memory corruption\n issues were addressed with improved memory handling. \n Credit to Zach Markley. \n Impact: Processing maliciously crafted web content may lead to\n arbitrary code execution. Description: Multiple memory corruption\n issues were addressed with improved memory handling. \n Credit to likemeng of Baidu Security Lab working with Trend Micro\u0027s\n Zero Day Initiative. \n Impact: Processing maliciously crafted web content may lead to\n arbitrary code execution. Description: Multiple memory corruption\n issues were addressed with improved memory handling. \n Credit to Anton Lopanitsyn of Wallarm, Linus Sarud of Detectify\n (detectify.com), Yuji Tounai of NTT Communications Corporation. \n Impact: Visiting a maliciously crafted website may lead to a cross-\n site scripting attack. Description: A cross-site scripting issue\n existed in WebKit. This issue was addressed with improved URL\n validation. \n Credit to OSS-Fuzz. \n Impact: Processing maliciously crafted web content may lead to a\n denial of service. Description: A memory corruption issue was\n addressed through improved input validation. \n Credit to WanderingGlitch of Trend Micro\u0027s Zero Day Initiative. \n Impact: Processing maliciously crafted web content may lead to\n arbitrary code execution. Description: Multiple memory corruption\n issues were addressed with improved memory handling. \n Credit to WanderingGlitch of Trend Micro\u0027s Zero Day Initiative. \n Impact: Processing maliciously crafted web content may lead to\n arbitrary code execution. Description: Multiple memory corruption\n issues were addressed with improved memory handling. \n Credit to WanderingGlitch of Trend Micro\u0027s Zero Day Initiative. \n Impact: Processing maliciously crafted web content may lead to\n arbitrary code execution. Description: Multiple memory corruption\n issues were addressed with improved memory handling. \n Credit to Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan Team. \n Impact: Processing maliciously crafted web content may lead to\n arbitrary code execution. Description: Multiple memory corruption\n issues were addressed with improved memory handling. \n\n\nWe recommend updating to the last stable version of WebKitGTK+. It is\nthe best way of ensuring that you are running a safe version of\nWebKitGTK+. Please check our website for information about the last\nstable releases. \n\nFurther information about WebKitGTK+ Security Advisories can be found\nat: https://webkitgtk.org/security.html\n\nThe WebKitGTK+ team,\nApril 04, 2018\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\nAPPLE-SA-2018-3-29-1 iOS 11.3\n\niOS 11.3 is now available and addresses the following:\n\nClock\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A person with physical access to an iOS device may be able to\nsee the email address used for iTunes\nDescription: An information disclosure issue existed in the handling\nof alarms and timers. \nCVE-2018-4123: Zaheen Hafzar M M (@zaheenhafzer)\n\nCoreFoundation\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to gain elevated privileges\nDescription: A race condition was addressed with additional\nvalidation. \nCVE-2018-4155: Samuel GroA (@5aelo)\nCVE-2018-4158: Samuel GroA (@5aelo)\n\nCoreText\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing a maliciously crafted string may lead to a denial\nof service\nDescription: A denial of service issue was addressed through improved\nmemory handling. \nCVE-2018-4142: Robin Leroy of Google Switzerland GmbH\n\nFile System Events\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to gain elevated privileges\nDescription: A race condition was addressed with additional\nvalidation. \nCVE-2018-4167: Samuel GroA (@5aelo)\n\nFiles Widget\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: File Widget may display contents on a locked device\nDescription: The File Widget was displaying cached data when in the\nlocked state. \nCVE-2018-4168: Brandon Moore\n\nFind My iPhone\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A person with physical access to the device may be able to\ndisable Find My iPhone without entering an iCloud password\nDescription: A state management issue existed when restoring from a\nback up. \nCVE-2018-4172: Viljami VastamA$?ki\n\niCloud Drive\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to gain elevated privileges\nDescription: A race condition was addressed with additional\nvalidation. \nCVE-2018-4151: Samuel GroA (@5aelo)\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A malicious application may be able to execute arbitrary code\nwith kernel privileges\nDescription: Multiple memory corruption issues were addressed with\nimproved memory handling. \nCVE-2018-4150: an anonymous researcher\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to read restricted memory\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2018-4104: The UK\u0027s National Cyber Security Centre (NCSC)\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2018-4143: derrek (@derrekr6)\n\nMail\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An attacker in a privileged network position may be able to\nintercept the contents of S/MIME-encrypted e-mail\nDescription: An inconsistent user interface issue was addressed with\nimproved state management. \nCVE-2018-4174: an anonymous researcher, an anonymous researcher\n\nNSURLSession\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to gain elevated privileges\nDescription: A race condition was addressed with additional\nvalidation. \nCVE-2018-4166: Samuel GroA (@5aelo)\n\nPluginKit\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to gain elevated privileges\nDescription: A race condition was addressed with additional\nvalidation. \nCVE-2018-4156: Samuel GroA (@5aelo)\n\nQuick Look\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to gain elevated privileges\nDescription: A race condition was addressed with additional\nvalidation. \nCVE-2018-4157: Samuel GroA (@5aelo)\n\nSafari\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Visiting a malicious website by clicking a link may lead to\nuser interface spoofing\nDescription: An inconsistent user interface issue was addressed with\nimproved state management. \nCVE-2018-4134: xisigr of Tencent\u0027s Xuanwu Lab (tencent.com), Zhiyang\nZeng (@Wester) of Tencent Security Platform Department\n\nSafari Login AutoFill\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A malicious website may be able to exfiltrate autofilled data\nin Safari without explicit user interaction. \nDescription: Safari autofill did not require explicit user\ninteraction before taking place. \nCVE-2018-4137:\n\nSafariViewController\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Visiting a malicious website may lead to user interface\nspoofing\nDescription: A state management issue was addressed by disabling text\ninput until the destination page loads. \nCVE-2018-4149: Abhinash Jain (@abhinashjain)\n\nSecurity\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A malicious application may be able to elevate privileges\nDescription: A buffer overflow was addressed with improved size\nvalidation. \nCVE-2018-4144: Abraham Masri (@cheesecakeufo)\n\nStorage\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to gain elevated privileges\nDescription: A race condition was addressed with additional\nvalidation. \nCVE-2018-4154: Samuel GroA (@5aelo)\n\nSystem Preferences\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A configuration profile may incorrectly remain in effect\nafter removal\nDescription: An issue existed in CFPreferences. \nCVE-2018-4115: Johann Thalakada, Vladimir Zubkov, and Matt Vlasach of\nWandera\n\nTelephony\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A remote attacker can cause a device to unexpectedly restart\nDescription: A null pointer dereference issue existed when handling\nClass 0 SMS messages. \nCVE-2018-4140: @mjonsson, Arjan van der Oest of Voiceworks BV\n\nWeb App\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Cookies may unexpectedly persist in web app\nDescription: A cookie management issue was addressed through improved\nstate management. \nCVE-2018-4110: Ben Compton and Jason Colley of Cerner Corporation\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: Multiple memory corruption issues were addressed with\nimproved memory handling. \nCVE-2018-4146: found by OSS-Fuzz\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A malicious website may exfiltrate data cross-origin\nDescription: A cross-origin issue existed with the fetch API. \nCVE-2018-4117: an anonymous researcher, an anonymous researcher\n\nWindowServer\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An unprivileged application may be able to log keystrokes\nentered into other applications even when secure input mode is\nenabled\nDescription: By scanning key states, an unprivileged application\ncould log keystrokes entered into other applications even when secure\ninput mode was enabled. \nCVE-2018-4131: Andreas Hegenberg of folivora.AI GmbH\n\nAdditional recognition\n\nWebKit\nWe would like to acknowledge Johnny Nipper of Tinder Security Team\nfor their assistance. \n\nInstallation note:\n\nThis update is available through iTunes and Software Update on your\niOS device, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes\nfrom https://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is\npresented to the user when the iOS device is docked. We recommend\napplying the update immediately if possible. Selecting Don\u0027t Install\nwill present the option the next time you connect your iOS device. \n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device. \n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About. \n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\n\niQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlq9GlopHHByb2R1Y3Qt\nc2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbhLRAA\nto9k0U/CI3PfYp2o2lluS7LgE3jvA7+pXvdjbvoh14BFHf9Wv+yhdtyLQEDSne+0\nTM8BkiMgEmo+uKKcVFCDeV9GrkWqO7ocBfT65hj4A/vxPAS6xlBTV9mjZXiqvSWs\n+Cbb4Nd53o6m2QRORkjNVZ2h0ow53J5RirnyzjWt4LMdCpc4jMG87OCuQheKzjxq\ng6gOlwblVrRxH6aMX5if/SetGGxzZeY5sKwe1Xhz6yIYsm1Gw45REt3FJs4KEh5Z\noL+yWVvaGLOPDzC+DBX0dXJmsqLx9wzDJsqQ2J6Mb/nh1Tgh6NDdHkDCAZ7P6CeU\n0IpXK7aaPkRy5GUbkAdzdPEFql9e0/jGlqMf/rZlNTItbgtn0+9e2zsJ0UPPRcWi\n+7IQygkXnXmYUZ0wrh/Wdye/jAJZpLdsUuWr1RalTdmDASU/tzgpoglf3EyTQoRy\nIqFGRSe6+no8Pw1qCLUvZz8C6dTKvE+Jv5oe9XbCEjsvpRmQZK64FiQ0HIaAMHKo\nRl9OY6+evzyqdAtivE4AFCRT7Z15pktFYAVefWkdVFbVU2mCYF+peXIq6tGg4o+g\n70E29XaDZBakcVho9bW4e2rDA+m606ILuZ4AyjEEvfRYH+d+WTvDqdIywq0V7grj\nqlU787sRw/tVx646jcHVqbYZEgZVmeAvcT8C2c0Zhvo=\n=RJi8\n-----END PGP SIGNATURE-----\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4256-1 security@debian.org\nhttps://www.debian.org/security/ Michael Gilbert\nJuly 26, 2018 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : chromium-browser\nCVE ID : CVE-2018-4117 CVE-2018-6044 CVE-2018-6150 CVE-2018-6151\n CVE-2018-6152 CVE-2018-6153 CVE-2018-6154 CVE-2018-6155\n CVE-2018-6156 CVE-2018-6157 CVE-2018-6158 CVE-2018-6159\n CVE-2018-6161 CVE-2018-6162 CVE-2018-6163 CVE-2018-6164\n CVE-2018-6165 CVE-2018-6166 CVE-2018-6167 CVE-2018-6168\n CVE-2018-6169 CVE-2018-6170 CVE-2018-6171 CVE-2018-6172\n CVE-2018-6173 CVE-2018-6174 CVE-2018-6175 CVE-2018-6176\n CVE-2018-6177 CVE-2018-6178 CVE-2018-6179\n\nSeveral vulnerabilities have been discovered in the chromium web browser. \n\nCVE-2018-6044\n\n Rob Wu discovered a way to escalate privileges using extensions. \n\nCVE-2018-6150\n\n Rob Wu discovered an information disclosure issue (this problem was\n fixed in a previous release but was mistakenly omitted from upstream\u0027s\n announcement at the time). \n\nCVE-2018-6151\n\n Rob Wu discovered an issue in the developer tools (this problem was\n fixed in a previous release but was mistakenly omitted from upstream\u0027s\n announcement at the time). \n\nCVE-2018-6152\n\n Rob Wu discovered an issue in the developer tools (this problem was\n fixed in a previous release but was mistakenly omitted from upstream\u0027s\n announcement at the time). \n\nCVE-2018-6153\n\n Zhen Zhou discovered a buffer overflow issue in the skia library. \n\nCVE-2018-6158\n\n Zhe Jin discovered a use-after-free issue. \n\nCVE-2018-6159\n\n Jun Kokatsu discovered a way to bypass the same origin policy. \n\nCVE-2018-6161\n\n Jun Kokatsu discovered a way to bypass the same origin policy. \n\nCVE-2018-6164\n\n Jun Kokatsu discovered a way to bypass the same origin policy. \n\nCVE-2018-6168\n\n Gunes Acar and Danny Y. Huang discovered a way to bypass the Cross\n Origin Resource Sharing policy. \n\nCVE-2018-6169\n\n Sam P discovered a way to bypass permissions when installing\n extensions. \n\nCVE-2018-6174\n\n Mark Brand discovered an integer overflow issue in the swiftshader\n library. \n\nCVE-2018-6176\n\n Jann Horn discovered a way to escalate privileges using extensions. \n\nCVE-2018-6177\n\n Ron Masas discovered an information leak. \n\nCVE-2018-6178\n\n Khalil Zhani discovered a user interface spoofing issue. \n\nCVE-2018-6179\n\n It was discovered that information about files local to the system\n could be leaked to extensions. \n\nThis version also fixes a regression introduced in the previous security\nupdate that could prevent decoding of particular audio/video codecs. \n\nWe recommend that you upgrade your chromium-browser packages. ==========================================================================\nUbuntu Security Notice USN-3635-1\nApril 30, 2018\n\nwebkit2gtk vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 17.10\n- Ubuntu 16.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in WebKitGTK+. \n\nSoftware Description:\n- webkit2gtk: Web content engine library for GTK+\n\nDetails:\n\nA large number of security issues were discovered in the WebKitGTK+ Web and\nJavaScript engines. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 17.10:\n libjavascriptcoregtk-4.0-18 2.20.1-0ubuntu0.17.10.1\n libwebkit2gtk-4.0-37 2.20.1-0ubuntu0.17.10.1\n\nUbuntu 16.04 LTS:\n libjavascriptcoregtk-4.0-18 2.20.1-0ubuntu0.16.04.1\n libwebkit2gtk-4.0-37 2.20.1-0ubuntu0.16.04.1\n\nThis update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any applications\nthat use WebKitGTK+, such as Epiphany, to make all the necessary changes. Summary:\n\nAn update for chromium-browser is now available for Red Hat Enterprise\nLinux 6 Supplementary. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64\nRed Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64\nRed Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64\n\n3. Description:\n\nChromium is an open-source web browser, powered by WebKit (Blink). \n\nSecurity Fix(es):\n\n* chromium-browser: Stack buffer overflow in Skia (CVE-2018-6153)\n\n* chromium-browser: Heap buffer overflow in WebGL (CVE-2018-6154)\n\n* chromium-browser: Use after free in WebRTC (CVE-2018-6155)\n\n* chromium-browser: Heap buffer overflow in WebRTC (CVE-2018-6156)\n\n* chromium-browser: Type confusion in WebRTC (CVE-2018-6157)\n\n* chromium-browser: Cross origin information disclosure in Service Workers\n(CVE-2018-6150)\n\n* chromium-browser: Bad cast in DevTools (CVE-2018-6151)\n\n* chromium-browser: Local file write in DevTools (CVE-2018-6152)\n\n* chromium-browser: Use after free in Blink (CVE-2018-6158)\n\n* chromium-browser: Same origin policy bypass in ServiceWorker\n(CVE-2018-6159)\n\n* chromium-browser: Same origin policy bypass in WebAudio (CVE-2018-6161)\n\n* chromium-browser: Heap buffer overflow in WebGL (CVE-2018-6162)\n\n* chromium-browser: URL spoof in Omnibox (CVE-2018-6163)\n\n* chromium-browser: Same origin policy bypass in ServiceWorker\n(CVE-2018-6164)\n\n* chromium-browser: URL spoof in Omnibox (CVE-2018-6165)\n\n* chromium-browser: URL spoof in Omnibox (CVE-2018-6166)\n\n* chromium-browser: URL spoof in Omnibox (CVE-2018-6167)\n\n* chromium-browser: CORS bypass in Blink (CVE-2018-6168)\n\n* chromium-browser: Permissions bypass in extension installation\n(CVE-2018-6169)\n\n* chromium-browser: Type confusion in PDFium (CVE-2018-6170)\n\n* chromium-browser: Use after free in WebBluetooth (CVE-2018-6171)\n\n* chromium-browser: URL spoof in Omnibox (CVE-2018-6172)\n\n* chromium-browser: URL spoof in Omnibox (CVE-2018-6173)\n\n* chromium-browser: Integer overflow in SwiftShader (CVE-2018-6174)\n\n* chromium-browser: URL spoof in Omnibox (CVE-2018-6175)\n\n* chromium-browser: Local user privilege escalation in Extensions\n(CVE-2018-6176)\n\n* chromium-browser: Cross origin information leak in Blink (CVE-2018-4117)\n\n* chromium-browser: Request privilege escalation in Extensions\n(CVE-2018-6044)\n\n* chromium-browser: Cross origin information leak in Blink (CVE-2018-6177)\n\n* chromium-browser: UI spoof in Extensions (CVE-2018-6178)\n\n* chromium-browser: Local file information leak in Extensions\n(CVE-2018-6179)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, refer to the CVE page(s) listed in\nthe References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to\ntake effect. \n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1608177 - CVE-2018-6153 chromium-browser: Stack buffer overflow in Skia\n1608178 - CVE-2018-6154 chromium-browser: Heap buffer overflow in WebGL\n1608179 - CVE-2018-6155 chromium-browser: Use after free in WebRTC\n1608180 - CVE-2018-6156 chromium-browser: Heap buffer overflow in WebRTC\n1608181 - CVE-2018-6157 chromium-browser: Type confusion in WebRTC\n1608182 - CVE-2018-6158 chromium-browser: Use after free in Blink\n1608183 - CVE-2018-6159 chromium-browser: Same origin policy bypass in ServiceWorker\n1608185 - CVE-2018-6161 chromium-browser: Same origin policy bypass in WebAudio\n1608186 - CVE-2018-6162 chromium-browser: Heap buffer overflow in WebGL\n1608187 - CVE-2018-6163 chromium-browser: URL spoof in Omnibox\n1608188 - CVE-2018-6164 chromium-browser: Same origin policy bypass in ServiceWorker\n1608189 - CVE-2018-6165 chromium-browser: URL spoof in Omnibox\n1608190 - CVE-2018-6166 chromium-browser: URL spoof in Omnibox\n1608191 - CVE-2018-6167 chromium-browser: URL spoof in Omnibox\n1608192 - CVE-2018-6168 chromium-browser: CORS bypass in Blink\n1608193 - CVE-2018-6169 chromium-browser: Permissions bypass in extension installation\n1608194 - CVE-2018-6170 chromium-browser: Type confusion in PDFium\n1608195 - CVE-2018-6171 chromium-browser: Use after free in WebBluetooth\n1608196 - CVE-2018-6172 chromium-browser: URL spoof in Omnibox\n1608197 - CVE-2018-6173 chromium-browser: URL spoof in Omnibox\n1608198 - CVE-2018-6174 chromium-browser: Integer overflow in SwiftShader\n1608199 - CVE-2018-6175 chromium-browser: URL spoof in Omnibox\n1608200 - CVE-2018-6176 chromium-browser: Local user privilege escalation in Extensions\n1608201 - CVE-2018-6177 chromium-browser: Cross origin information leak in Blink\n1608202 - CVE-2018-6178 chromium-browser: UI spoof in Extensions\n1608203 - CVE-2018-6179 chromium-browser: Local file information leak in Extensions\n1608204 - CVE-2018-6044 chromium-browser: Request privilege escalation in Extensions\n1608205 - CVE-2018-4117 chromium-browser: Cross origin information leak in Blink\n1608206 - CVE-2018-6150 chromium-browser: Cross origin information disclosure in Service Workers\n1608207 - CVE-2018-6151 chromium-browser: Bad cast in DevTools\n1608208 - CVE-2018-6152 chromium-browser: Local file write in DevTools\n\n6. Package List:\n\nRed Hat Enterprise Linux Desktop Supplementary (v. 6):\n\ni386:\nchromium-browser-68.0.3440.75-1.el6_10.i686.rpm\nchromium-browser-debuginfo-68.0.3440.75-1.el6_10.i686.rpm\n\nx86_64:\nchromium-browser-68.0.3440.75-1.el6_10.x86_64.rpm\nchromium-browser-debuginfo-68.0.3440.75-1.el6_10.x86_64.rpm\n\nRed Hat Enterprise Linux Server Supplementary (v. 6):\n\ni386:\nchromium-browser-68.0.3440.75-1.el6_10.i686.rpm\nchromium-browser-debuginfo-68.0.3440.75-1.el6_10.i686.rpm\n\nx86_64:\nchromium-browser-68.0.3440.75-1.el6_10.x86_64.rpm\nchromium-browser-debuginfo-68.0.3440.75-1.el6_10.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Supplementary (v. 6):\n\ni386:\nchromium-browser-68.0.3440.75-1.el6_10.i686.rpm\nchromium-browser-debuginfo-68.0.3440.75-1.el6_10.i686.rpm\n\nx86_64:\nchromium-browser-68.0.3440.75-1.el6_10.x86_64.rpm\nchromium-browser-debuginfo-68.0.3440.75-1.el6_10.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2018-4117\nhttps://access.redhat.com/security/cve/CVE-2018-6044\nhttps://access.redhat.com/security/cve/CVE-2018-6150\nhttps://access.redhat.com/security/cve/CVE-2018-6151\nhttps://access.redhat.com/security/cve/CVE-2018-6152\nhttps://access.redhat.com/security/cve/CVE-2018-6153\nhttps://access.redhat.com/security/cve/CVE-2018-6154\nhttps://access.redhat.com/security/cve/CVE-2018-6155\nhttps://access.redhat.com/security/cve/CVE-2018-6156\nhttps://access.redhat.com/security/cve/CVE-2018-6157\nhttps://access.redhat.com/security/cve/CVE-2018-6158\nhttps://access.redhat.com/security/cve/CVE-2018-6159\nhttps://access.redhat.com/security/cve/CVE-2018-6161\nhttps://access.redhat.com/security/cve/CVE-2018-6162\nhttps://access.redhat.com/security/cve/CVE-2018-6163\nhttps://access.redhat.com/security/cve/CVE-2018-6164\nhttps://access.redhat.com/security/cve/CVE-2018-6165\nhttps://access.redhat.com/security/cve/CVE-2018-6166\nhttps://access.redhat.com/security/cve/CVE-2018-6167\nhttps://access.redhat.com/security/cve/CVE-2018-6168\nhttps://access.redhat.com/security/cve/CVE-2018-6169\nhttps://access.redhat.com/security/cve/CVE-2018-6170\nhttps://access.redhat.com/security/cve/CVE-2018-6171\nhttps://access.redhat.com/security/cve/CVE-2018-6172\nhttps://access.redhat.com/security/cve/CVE-2018-6173\nhttps://access.redhat.com/security/cve/CVE-2018-6174\nhttps://access.redhat.com/security/cve/CVE-2018-6175\nhttps://access.redhat.com/security/cve/CVE-2018-6176\nhttps://access.redhat.com/security/cve/CVE-2018-6177\nhttps://access.redhat.com/security/cve/CVE-2018-6178\nhttps://access.redhat.com/security/cve/CVE-2018-6179\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2018 Red Hat, Inc. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201808-01\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n Title: Chromium, Google Chrome: Multiple vulnerabilities\n Date: August 22, 2018\n Bugs: #657376, #662436\n ID: 201808-01\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in Chromium and Google Chrome,\nthe worst of which allows remote attackers to escalate privileges. \n\nBackground\n==========\n\nChromium is an open-source browser project that aims to build a safer,\nfaster, and more stable way for all users to experience the web. \n\nGoogle Chrome is one fast, simple, and secure browser for all your\ndevices. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 www-client/chromium \u003c 68.0.3440.75 \u003e= 68.0.3440.75\n 2 www-client/google-chrome\n \u003c 68.0.3440.75 \u003e= 68.0.3440.75\n -------------------------------------------------------------------\n 2 affected packages\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in Chromium and Google\nChrome. Please review the referenced CVE identifiers and Google Chrome\nReleases for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Chromium users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot -v \"\u003e=www-client/chromium-68.0.3440.75\"\n\nAll Google Chrome users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot -v \"\u003e=www-client/google-chrome-68.0.3440.75\"\n\nReferences\n==========\n\n[ 1 ] CVE-2018-4117\n https://nvd.nist.gov/vuln/detail/CVE-2018-4117\n[ 2 ] CVE-2018-6044\n https://nvd.nist.gov/vuln/detail/CVE-2018-6044\n[ 3 ] CVE-2018-6150\n https://nvd.nist.gov/vuln/detail/CVE-2018-6150\n[ 4 ] CVE-2018-6151\n https://nvd.nist.gov/vuln/detail/CVE-2018-6151\n[ 5 ] CVE-2018-6152\n https://nvd.nist.gov/vuln/detail/CVE-2018-6152\n[ 6 ] CVE-2018-6153\n https://nvd.nist.gov/vuln/detail/CVE-2018-6153\n[ 7 ] CVE-2018-6154\n https://nvd.nist.gov/vuln/detail/CVE-2018-6154\n[ 8 ] CVE-2018-6155\n https://nvd.nist.gov/vuln/detail/CVE-2018-6155\n[ 9 ] CVE-2018-6156\n https://nvd.nist.gov/vuln/detail/CVE-2018-6156\n[ 10 ] CVE-2018-6157\n https://nvd.nist.gov/vuln/detail/CVE-2018-6157\n[ 11 ] CVE-2018-6158\n https://nvd.nist.gov/vuln/detail/CVE-2018-6158\n[ 12 ] CVE-2018-6159\n https://nvd.nist.gov/vuln/detail/CVE-2018-6159\n[ 13 ] CVE-2018-6160\n https://nvd.nist.gov/vuln/detail/CVE-2018-6160\n[ 14 ] CVE-2018-6161\n https://nvd.nist.gov/vuln/detail/CVE-2018-6161\n[ 15 ] CVE-2018-6162\n https://nvd.nist.gov/vuln/detail/CVE-2018-6162\n[ 16 ] CVE-2018-6163\n https://nvd.nist.gov/vuln/detail/CVE-2018-6163\n[ 17 ] CVE-2018-6164\n https://nvd.nist.gov/vuln/detail/CVE-2018-6164\n[ 18 ] CVE-2018-6165\n https://nvd.nist.gov/vuln/detail/CVE-2018-6165\n[ 19 ] CVE-2018-6166\n https://nvd.nist.gov/vuln/detail/CVE-2018-6166\n[ 20 ] CVE-2018-6167\n https://nvd.nist.gov/vuln/detail/CVE-2018-6167\n[ 21 ] CVE-2018-6168\n https://nvd.nist.gov/vuln/detail/CVE-2018-6168\n[ 22 ] CVE-2018-6169\n https://nvd.nist.gov/vuln/detail/CVE-2018-6169\n[ 23 ] CVE-2018-6170\n https://nvd.nist.gov/vuln/detail/CVE-2018-6170\n[ 24 ] CVE-2018-6171\n https://nvd.nist.gov/vuln/detail/CVE-2018-6171\n[ 25 ] CVE-2018-6172\n https://nvd.nist.gov/vuln/detail/CVE-2018-6172\n[ 26 ] CVE-2018-6173\n https://nvd.nist.gov/vuln/detail/CVE-2018-6173\n[ 27 ] CVE-2018-6174\n https://nvd.nist.gov/vuln/detail/CVE-2018-6174\n[ 28 ] CVE-2018-6175\n https://nvd.nist.gov/vuln/detail/CVE-2018-6175\n[ 29 ] CVE-2018-6176\n https://nvd.nist.gov/vuln/detail/CVE-2018-6176\n[ 30 ] CVE-2018-6177\n https://nvd.nist.gov/vuln/detail/CVE-2018-6177\n[ 31 ] CVE-2018-6178\n https://nvd.nist.gov/vuln/detail/CVE-2018-6178\n[ 32 ] CVE-2018-6179\n https://nvd.nist.gov/vuln/detail/CVE-2018-6179\n[ 33 ] CVE-2108-6150\n https://nvd.nist.gov/vuln/detail/CVE-2108-6150\n[ 34 ] Google Chrome 68.0.3440.75 release announcement\n\nhttps://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/201808-01\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2018 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-4117"
},
{
"db": "VULHUB",
"id": "VHN-134148"
},
{
"db": "VULMON",
"id": "CVE-2018-4117"
},
{
"db": "PACKETSTORM",
"id": "149059"
},
{
"db": "PACKETSTORM",
"id": "147241"
},
{
"db": "PACKETSTORM",
"id": "146964"
},
{
"db": "PACKETSTORM",
"id": "148722"
},
{
"db": "PACKETSTORM",
"id": "147433"
},
{
"db": "PACKETSTORM",
"id": "148738"
},
{
"db": "PACKETSTORM",
"id": "146970"
},
{
"db": "PACKETSTORM",
"id": "149044"
},
{
"db": "PACKETSTORM",
"id": "146971"
}
],
"trust": 1.89
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-4117",
"trust": 2.7
},
{
"db": "SECTRACK",
"id": "1040604",
"trust": 1.2
},
{
"db": "BID",
"id": "104887",
"trust": 1.2
},
{
"db": "CNNVD",
"id": "CNNVD-201804-188",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "148738",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "149044",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "148722",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-134148",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2018-4117",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "149059",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "147241",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "146964",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "147433",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "146970",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "146971",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-134148"
},
{
"db": "VULMON",
"id": "CVE-2018-4117"
},
{
"db": "PACKETSTORM",
"id": "149059"
},
{
"db": "PACKETSTORM",
"id": "147241"
},
{
"db": "PACKETSTORM",
"id": "146964"
},
{
"db": "PACKETSTORM",
"id": "148722"
},
{
"db": "PACKETSTORM",
"id": "147433"
},
{
"db": "PACKETSTORM",
"id": "148738"
},
{
"db": "PACKETSTORM",
"id": "146970"
},
{
"db": "PACKETSTORM",
"id": "149044"
},
{
"db": "PACKETSTORM",
"id": "146971"
},
{
"db": "CNNVD",
"id": "CNNVD-201804-188"
},
{
"db": "NVD",
"id": "CVE-2018-4117"
}
]
},
"id": "VAR-201804-1177",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-134148"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-29T19:34:15.728000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Multiple Apple product WebKit Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=83040"
},
{
"title": "Red Hat: CVE-2018-4117",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2018-4117"
},
{
"title": "Red Hat: Important: chromium-browser security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182282 - Security Advisory"
},
{
"title": "Apple: Safari 11.1",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=ee3f60ca20e25abaeeaa2929b7de559a"
},
{
"title": "Apple: watchOS 4.3",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=0c9672f464c8ecdde98d280637ecb1c5"
},
{
"title": "Apple: iCloud for Windows 7.4",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=3c324dcae1b032626ce2245c5900fb36"
},
{
"title": "Ubuntu Security Notice: webkit2gtk vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3635-1"
},
{
"title": "Apple: iTunes 12.7.4 for Windows",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=1b3706ef4ba6948ac20ebbbcffe7bc29"
},
{
"title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - October 2018",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=2196fa008592287290cbd6678fbe10d4"
},
{
"title": "Apple: iOS 11.3",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=66db9acd354635a683838e3cd9bc2d76"
},
{
"title": "Debian Security Advisories: DSA-4256-1 chromium-browser -- security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=1de398c860a3d18d1131a0f7f22cabdc"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2018-4117"
},
{
"db": "CNNVD",
"id": "CNNVD-201804-188"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-134148"
},
{
"db": "NVD",
"id": "CVE-2018-4117"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "https://support.apple.com/ht208693"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht208694"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht208695"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht208696"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht208697"
},
{
"trust": 1.3,
"url": "https://security.gentoo.org/glsa/201808-01"
},
{
"trust": 1.3,
"url": "https://security.gentoo.org/glsa/201808-04"
},
{
"trust": 1.3,
"url": "https://access.redhat.com/errata/rhsa-2018:2282"
},
{
"trust": 1.3,
"url": "https://usn.ubuntu.com/3635-1/"
},
{
"trust": 1.2,
"url": "http://www.securityfocus.com/bid/104887"
},
{
"trust": 1.2,
"url": "https://www.debian.org/security/2018/dsa-4256"
},
{
"trust": 1.2,
"url": "http://www.securitytracker.com/id/1040604"
},
{
"trust": 0.9,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4117"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4101"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4114"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4120"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4127"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4125"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4128"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4118"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4113"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4122"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4119"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4146"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4129"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4163"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4165"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4162"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4121"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4161"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4133"
},
{
"trust": 0.3,
"url": "https://support.apple.com/kb/ht201222"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4144"
},
{
"trust": 0.3,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4130"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6154"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6171"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6167"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6169"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6166"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6163"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6170"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6161"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6155"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6162"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6175"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6176"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6174"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6156"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6164"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6168"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6159"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6172"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6157"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6044"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6158"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6173"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6152"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6151"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6165"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6153"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6150"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2018-4117"
},
{
"trust": 0.2,
"url": "https://webkitgtk.org/security/wsa-2018-0003.html"
},
{
"trust": 0.2,
"url": "https://security.gentoo.org/"
},
{
"trust": 0.2,
"url": "https://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.2,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4265"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4233"
},
{
"trust": 0.1,
"url": "https://webkitgtk.org/security/wsa-2018-0004.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4190"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4264"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4232"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4261"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-11713"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4204"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4263"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-11646"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4270"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4214"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12293"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12294"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4262"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4284"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4266"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4273"
},
{
"trust": 0.1,
"url": "https://webkitgtk.org/security/wsa-2018-0006.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4192"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4201"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4222"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4267"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4272"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4200"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4199"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-11712"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4278"
},
{
"trust": 0.1,
"url": "https://webkitgtk.org/security/wsa-2018-0005.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4218"
},
{
"trust": 0.1,
"url": "https://webkitgtk.org/security.html"
},
{
"trust": 0.1,
"url": "https://www.apple.com/itunes/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4123"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4143"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4142"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4149"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4110"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4134"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4140"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4131"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4115"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4104"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4150"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4137"
},
{
"trust": 0.1,
"url": "https://security-tracker.debian.org/tracker/chromium-browser"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://usn.ubuntu.com/usn/usn-3635-1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/webkit2gtk/2.20.1-0ubuntu0.16.04.1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/webkit2gtk/2.20.1-0ubuntu0.17.10.1"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6157"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6168"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6152"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6155"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6164"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6151"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6161"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6174"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6167"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6176"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6159"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6158"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6044"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6175"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6156"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6166"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6173"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6178"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6179"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6154"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6163"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6171"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6153"
},
{
"trust": 0.1,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6172"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6165"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6177"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6170"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6162"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6169"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-6150"
},
{
"trust": 0.1,
"url": "https://www.apple.com/itunes/download/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6178"
},
{
"trust": 0.1,
"url": "https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6160"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6179"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-6177"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2108-6150"
},
{
"trust": 0.1,
"url": "https://support.apple.com/ht204283"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-134148"
},
{
"db": "VULMON",
"id": "CVE-2018-4117"
},
{
"db": "PACKETSTORM",
"id": "149059"
},
{
"db": "PACKETSTORM",
"id": "147241"
},
{
"db": "PACKETSTORM",
"id": "146964"
},
{
"db": "PACKETSTORM",
"id": "148722"
},
{
"db": "PACKETSTORM",
"id": "147433"
},
{
"db": "PACKETSTORM",
"id": "148738"
},
{
"db": "PACKETSTORM",
"id": "146970"
},
{
"db": "PACKETSTORM",
"id": "149044"
},
{
"db": "PACKETSTORM",
"id": "146971"
},
{
"db": "CNNVD",
"id": "CNNVD-201804-188"
},
{
"db": "NVD",
"id": "CVE-2018-4117"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-134148"
},
{
"db": "VULMON",
"id": "CVE-2018-4117"
},
{
"db": "PACKETSTORM",
"id": "149059"
},
{
"db": "PACKETSTORM",
"id": "147241"
},
{
"db": "PACKETSTORM",
"id": "146964"
},
{
"db": "PACKETSTORM",
"id": "148722"
},
{
"db": "PACKETSTORM",
"id": "147433"
},
{
"db": "PACKETSTORM",
"id": "148738"
},
{
"db": "PACKETSTORM",
"id": "146970"
},
{
"db": "PACKETSTORM",
"id": "149044"
},
{
"db": "PACKETSTORM",
"id": "146971"
},
{
"db": "CNNVD",
"id": "CNNVD-201804-188"
},
{
"db": "NVD",
"id": "CVE-2018-4117"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-04-03T00:00:00",
"db": "VULHUB",
"id": "VHN-134148"
},
{
"date": "2018-04-03T00:00:00",
"db": "VULMON",
"id": "CVE-2018-4117"
},
{
"date": "2018-08-23T18:40:24",
"db": "PACKETSTORM",
"id": "149059"
},
{
"date": "2018-04-18T13:33:33",
"db": "PACKETSTORM",
"id": "147241"
},
{
"date": "2018-03-30T15:52:10",
"db": "PACKETSTORM",
"id": "146964"
},
{
"date": "2018-07-27T15:53:07",
"db": "PACKETSTORM",
"id": "148722"
},
{
"date": "2018-05-02T04:32:41",
"db": "PACKETSTORM",
"id": "147433"
},
{
"date": "2018-07-30T17:19:05",
"db": "PACKETSTORM",
"id": "148738"
},
{
"date": "2018-03-30T15:55:41",
"db": "PACKETSTORM",
"id": "146970"
},
{
"date": "2018-08-22T23:01:00",
"db": "PACKETSTORM",
"id": "149044"
},
{
"date": "2018-03-30T15:56:03",
"db": "PACKETSTORM",
"id": "146971"
},
{
"date": "2018-04-03T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201804-188"
},
{
"date": "2018-04-03T06:29:04.937000",
"db": "NVD",
"id": "CVE-2018-4117"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-11-09T00:00:00",
"db": "VULHUB",
"id": "VHN-134148"
},
{
"date": "2018-11-09T00:00:00",
"db": "VULMON",
"id": "CVE-2018-4117"
},
{
"date": "2018-04-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201804-188"
},
{
"date": "2024-11-21T04:06:47.857000",
"db": "NVD",
"id": "CVE-2018-4117"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "147433"
},
{
"db": "PACKETSTORM",
"id": "149044"
},
{
"db": "CNNVD",
"id": "CNNVD-201804-188"
}
],
"trust": 0.8
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple Apple product WebKit Security hole",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201804-188"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201804-188"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.