Integer underflow in Google Chrome - CVE-2018-6036

Vulnerability identifier: #VU10238

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-6036

CWE-ID: CWE-191

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due integer underflow in WebAssembly. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and cause the service to crash.

Google Chrome
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for x86_64
SUSE Linux
Fedora
Opensuse
qt5-qtwebengine

Update to version 64.0.3282.119.

Google Chrome - update to 64.0.3282.119
qt5-qtwebengine - addressed in versions 5.10.1-1.fc26, 5.10.1-1.fc27

• https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html

• Multiple vulnerabilities in Google Chrome
• openSUSE update for chromium
• Debian update for chromium-browser
• SUSE Linux update for chromium
• Red Hat update for Google Chrome
• Gentoo update for Chromium, Google Chrome
• Fedora 27 update for qt5-qtwebengine
• Fedora 26 update for qt5-qtwebengine