Description
Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS breakdown
CVSS 3.0
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- Canonical / Ubuntu Linux16.04 – 16.04
- Canonical / Ubuntu Linux17.10 – 17.10
- Canonical / Ubuntu Linux14.04 – 14.04
- Debian / debian_linux8.0 – 8.0
- Debian / debian_linux9.0 – 9.0
- Google / Chrome63.0.3239.84
- icu-project / international_components_for_unicode60.1
- RedHat / enterprise_linux_desktop6.0 – 6.0
- RedHat / enterprise_linux_server6.0 – 6.0
- RedHat / enterprise_linux_workstation6.0 – 6.0
References
- VENDOR_ADVISORYhttps://www.debian.org/security/2018/dsa-4150
- MISChttps://crbug.com/774382
- VENDOR_ADVISORYhttps://usn.ubuntu.com/3610-1/
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2017:3401
- MISChttps://security.gentoo.org/glsa/201801-03
- MISChttps://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
Updated 17m ago · 8 sources