Actively exploited · Published Dec 11, 2018 · Assigned by Chrome

CVE-2018-17480

High 8.8 Exploited

In plain English

A high-severity out-of-bounds write in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on June 8, 2022). The chance it is exploited in the next 30 days is estimated at 35.6% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)35.6%top 1.5% of all CVEs

Exploited in the wildYesCISA KEV since Jun 8, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 22, 2022.

Official description

Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	chromium	71.0.3578.80-1	DEBIAN-CVE-2018-17480
Debian:13	chromium	71.0.3578.80-1	DEBIAN-CVE-2018-17480
Debian:14	chromium	71.0.3578.80-1	DEBIAN-CVE-2018-17480

Affected products (as reported)

Vendor	Product	Versions
Google	Chrome	unspecified – before 71.0.3578.80

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://crbug.com/905940 x_refsource_MISC
https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html x_refsource_CONFIRM
RHSA-2018:3803 vendor-advisory, x_refsource_REDHAT
DSA-4352 vendor-advisory, x_refsource_DEBIAN
106084 vdb-entry, x_refsource_BID
GLSA-201908-18 vendor-advisory, x_refsource_GENTOO
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-17480 government-resource