KLA11598 Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, spoof user interface.

Below is a complete list of vulnerabilities:

1. An out-of-bounds read in V8 can be exploited remotely to execute arbitrary code;
2. A use after free in PDFium can be exploited remotely to obtain sensitive information;
3. A heap overflow vulnerability in the Skia component can be exploited remotely to execute arbitrary code;
4. A use after free in PDFium can be exploited remotely to obtain sensitive information;
5. A use after free in Blink can be exploited remotely to obtain sensitive information;
6. A heap overflow vulnerability in the Canvas component can be exploited remotely to cause denial of service;
7. A use after free in WebAudio can be exploited remotely to bypass security restrictions;
8. A use after free in MediaRecorder can be exploited remotely to obtain sensitive information;
9. A heap overflow vulnerability in the Blink component can be exploited remotely spoof user interface;
10. An out-of-bounds read in V8 can be exploited remotely to cause denial of service;
11. A use after free in Skia can be exploited remotely to obtain sensitive information;
12. A use after free in Skia can be exploited remotely to obtain sensitive information;

Original advisories

Stable Channel Update for Desktop

Related products

Google-Chrome

Google-Chrome-Enterprise

Google-Chrome-Enterprise-for-current-user

Google-Chrome-for-KIS

Google-Chrome-for-current-user

CVE list

CVE-2018-20070 warning

CVE-2018-20065 high

CVE-2018-20068 warning

CVE-2018-20069 warning

CVE-2018-20071 warning

CVE-2018-20067 warning

CVE-2018-20066 high

Solution

Update to the latest version

Google Chrome download page

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Google Chrome earlier then 70.0.3538.67