CVE-2018-6126: debian debian_linux Out-of-bounds Write
CVSS: 8.8v3.0HighModified
AliasesMGASA-2018-0282SUSE-SU-2018:1783-1SUSE-SU-2018:1783-2SUSE-SU-2018:1820-1UBUNTU-CVE-2018-6126USN-3682-1DEBIAN-CVE-2018-6126DSA-4220-1
Published 09-01-2019Last modified 05-08-2024
Vulnerability summary
CVE-2018-6126 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 7.67% chance of exploitation in the next 30 days, higher than 94.5% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.8/10
010
High · v3.0 (NVD)EPSS score
7.67%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database
Advisory lineage
Upstream 0 · Downstream 11 · Related 5Timeline
- 09-01-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A precision error in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
7.67%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 7.67% on 18-09-2026
18-09-202618-10-2026
EPSS score7.67%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundSkia - Heap Overflow in SkScan::FillPath due to Precision Error
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Suse18 products
- MozillaFirefox&distro=SUSE Enterprise Storage 4< 52.8.1esr-109.34.1
- MozillaFirefox&distro=SUSE Linux Enterprise Desktop 12 SP3< 52.8.1esr-109.34.1
- MozillaFirefox&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 52.8.1esr-72.35.1
- MozillaFirefox&distro=SUSE Linux Enterprise Server 11 SP3-LTSS< 52.8.1esr-72.35.1
- MozillaFirefox&distro=SUSE Linux Enterprise Server 11 SP3-TERADATA< 52.8.1esr-72.35.1
Ubuntu4 products
- chromium-browser< 67.0.3396.99-0ubuntu0.16.04.2 | < 67.0.3396.99-0ubuntu0.18.04.1
- firefox< 60.0.2+build1-0ubuntu0.14.04.1 | < 60.0.2+build1-0ubuntu0.16.04.1 | < 60.0.2+build1-0ubuntu0.18.04.1
- oxide-qtAll versions (No fix recorded)
- thunderbird< 1:60.2.1+build1-0ubuntu0.14.04.2 | < 1:60.2.1+build1-0ubuntu0.16.04.4 | < 1:60.2.1+build1-0ubuntu0.18.04.2
Redhat3 products
Debian2 products
- firefox-esr< 52.8.1esr-1 | < 52.8.1esr-1~deb8u1 | < 52.8.1esr-1~deb9u1
- debian_linuxEOL8.0 | 9.0
Mageia2 products
- firefox< 52.8.1-1.mga6
- firefox-l10n< 52.8.1-1.mga6
Google1 product
- chrome≥ unspecified, < 67.0.3396.62 | < 67.0.3396.62
6 vendors · 30 products
References
26 links- chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.htmlX Refsource CONFIRMREPORT
Show all 26 references
- crbug.com/844457X Refsource MISC