TTCSIRT-097.031218: TT-CSIRT Advisory – Chrome Security Updates

Google has reported that the following vulnerabilities have been discovered in Google Chrome:

a) Use after free in Flash – (CVE-2018-6058, CVE-2018-6059)

b) Incorrect permissions on shared memory – (CVE-2018-6057, CVE-2018-6063)

c) Use after free in Blink – (CVE-2018-6060)

d) Race condition in V8 – (CVE-2018-6061)

e) Heap buffer overflow in Skia – (CVE-2018-6062)

f) Incorrect permissions on shared memory – (CVE-2018-6057, CVE-2018-6063)

g) Type confusion in V8 – (CVE-2018-6064)

h) Integer overflow in V8 – (CVE-2018-6065)

i) Same Origin Bypass via canvas – (CVE-2018-6066)

j) Buffer overflow in Skia – (CVE-2018-6067)

k) Object lifecycle issues in Chrome Custom Tab – (CVE-2018-6068)

l) Stack buffer overflow in Skia – (CVE-2018-6069)

m) CSP bypass through extensions – (CVE-2018-6070)

n) Heap bufffer overflow in Skia – (CVE-2018-6071)

o) Integer overflow in PDFium – (CVE-2018-6072)

p) Heap bufffer overflow in WebGL – (CVE-2018-6073)

q) Mark-of-the-Web bypass – (CVE-2018-6074)

r) Overly permissive cross origin downloads – (CVE-2018-6075)

s)Incorrect handling of URL fragment identifiers in Blink – (CVE-2018-6076)

t) Timing attack using SVG filters – (CVE-2018-6077)

u) URL Spoof in OmniBox – (CVE-2018-6078)

v) Information disclosure via texture data in WebGL – (CVE-2018-6079)

w) Information disclosure in IPC call – (CVE-2018-6080)

x) XSS in interstitials – (CVE-2018-6081)

y) Circumvention of port blocking – (CVE-2018-6082)

z) Incorrect processing of AppManifests – (CVE-2018-6083)

Successful exploitation of the most severe of these vulnerabilities could allow an attacker to execute arbitrary code in the context of the browser, obtain sensitive information, bypass security restrictions and perform unauthorized actions, or cause denial-of-service conditions.