Red Hat Linux Server vulnerabilities

44 CVEs affecting Red Hat Linux Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-18359, published 2018-12-11.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-6092, published 2018-12-04. High severity, CVSS 8.8. EPSS: 9.2% chance of exploitation in the next 30 days. An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2018-6085, published 2018-12-04. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
• CVE-2018-6087, published 2018-12-04. High severity, CVSS 8.8. EPSS: 3.5% chance of exploitation in the next 30 days. A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2018-6086, published 2018-12-04. High severity, CVSS 8.8. EPSS: 3.3% chance of exploitation in the next 30 days. A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a…
• CVE-2018-6090, published 2018-12-04. High severity, CVSS 8.8. EPSS: 3.3% chance of exploitation in the next 30 days. An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2018-6066, published 2018-11-14. Medium severity, CVSS 6.5. EPSS: 2.8% chance of exploitation in the next 30 days. Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2018-6101, published 2018-12-04. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if the user is running a remote DevTools…
• CVE-2018-6088, published 2018-12-04. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.
• CVE-2018-6073, published 2018-11-14. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. A heap buffer overflow in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
• CVE-2018-18337, published 2018-12-11. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Latest

• CVE-2018-18359, published 2018-12-11. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. Incorrect handling of Reflect.construct in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
• CVE-2018-18347, published 2018-12-11. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to trick a user into executing javascript in an arbitrary…
• CVE-2018-18346, published 2018-12-11. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. Incorrect handling of alert box display in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to present confusing browser UI via a crafted HTML page.
• CVE-2018-18343, published 2018-12-11. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. Incorrect handing of paths leading to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2018-18341, published 2018-12-11. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. An integer overflow leading to a heap buffer overflow in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2018-18340, published 2018-12-11. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. Incorrect object lifecycle in MediaRecorder in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2018-18339, published 2018-12-11. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. Incorrect object lifecycle in WebAudio in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2018-18338, published 2018-12-11. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. Incorrect, thread-unsafe use of SkImage in Canvas in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2018-18336, published 2018-12-11. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. Incorrect object lifecycle in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.