CVE-2018-6140

Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension.
References
Link Resource
https://crbug.com/798222 Exploit Issue Tracking Patch Vendor Advisory
https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html Release Notes Vendor Advisory
https://www.debian.org/security/2018/dsa-4237 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1815 Third Party Advisory
http://www.securitytracker.com/id/1041014 Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/104309 Third Party Advisory VDB Entry
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Information

Published : 2019-01-09 11:29

Updated : 2019-01-16 06:39


NVD link : CVE-2018-6140

Mitre link : CVE-2018-6140


JSON object : View

CWE
CWE-20

Improper Input Validation

Advertisement

dedicated server usa

Products Affected

redhat

  • enterprise_linux_desktop
  • enterprise_linux_workstation
  • enterprise_linux_server

google

  • chrome

debian

  • debian_linux