Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
The MITRE CVE dictionary describes this issue as:
Find out more about CVE-2018-17466 from the MITRE CVE dictionary dictionary and NIST NVD.
In general, this flaw be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.
| CVSS3 Base Score | 8.8 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity Impact | High |
| Availability Impact | High |
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Enterprise Linux 6 (thunderbird) | RHSA-2019:0159 | 2019-01-24 |
| Red Hat Enterprise Linux 7 (thunderbird) | RHSA-2019:0160 | 2019-01-24 |
| Red Hat Enterprise Linux 6 (firefox) | RHSA-2018:3831 | 2018-12-17 |
| Red Hat Enterprise Linux 7 (firefox) | RHSA-2018:3833 | 2018-12-17 |
| Red Hat Enterprise Linux Supplementary (v. 6) (chromium-browser) | RHSA-2018:3004 | 2018-10-24 |
Vulmon