CVE-2018-6076
published 2018-11-14CVE-2018-6076: Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack…
PriorityP424medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
1.16%
63.8th percentile
Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| chrome | < 65.0.3325.146 | 65.0.3325.146 | |
| chrome | >= unspecified < 65.0.3325.146 | 65.0.3325.146 | |
| redhat | linux_desktop | — | — |
| redhat | linux_server | — | — |
| redhat | linux_workstation | — | — |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
chromium-browser: incorrect handling of url fragment identifiers in blink
vendor_redhat·2018-03-06·CVSS 6.1
CVE-2018-6076 [MEDIUM] chromium-browser: incorrect handling of url fragment identifiers in blink
chromium-browser: incorrect handling of url fragment identifiers in blink
Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page.
GHSA
GHSA-h55r-r5c7-q23x: Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65
ghsa_unreviewed·2022-05-14
CVE-2018-6076 [MEDIUM] CWE-79 GHSA-h55r-r5c7-q23x: Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65
Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page.
OSV
CVE-2018-6076: Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65
osv·2018-11-14·CVSS 6.1
CVE-2018-6076 [MEDIUM] CVE-2018-6076: Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65
Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page.
No detection rules found.
No public exploits indexed.
Bugzilla
qt5-qtwebengine: 16 security vulnerabilities
bugzilla·2018-03-24·CVSS 6.1
CVE-2017-15429 [MEDIUM] qt5-qtwebengine: 16 security vulnerabilities
qt5-qtwebengine: 16 security vulnerabilities
Description of problem:
An update [https://bodhi.fedoraproject.org/updates/FEDORA-2018-b844991a97] is available fixing 16 security vulnerabilities in the qt5-qtwebengine currently in F28 Beta:
* CVE-2017-15429
* CVE-2018-6033 (claimed fixed in 5.10.1, but the fix was incomplete and had no effect; the update adds the missing part to make the fix effective)
* CVE-2018-6060
* CVE-2018-6062
* CVE-2018-6064
* CVE-2018-6069
* CVE-2018-6071
* CVE-2018-6073
* CVE-2018-6076
* CVE-2018-6079
* CVE-2018-6081
* CVE-2018-6082
* Chromium (security) Bug 770734
* Chromium (security) Bug 774833
* Chromium (security) Bug 798410
* Chromium (security) Bug 789764
I am therefore proposing this update:
https://bodhi.fedoraproject.org/updates/FEDORA-2018-b844991a97
as
Bugzilla
CVE-2018-6076 chromium-browser: incorrect handling of url fragment identifiers in blink
bugzilla·2018-03-07·CVSS 6.1
CVE-2018-6076 [MEDIUM] CVE-2018-6076 chromium-browser: incorrect handling of url fragment identifiers in blink
CVE-2018-6076 chromium-browser: incorrect handling of url fragment identifiers in blink
An incorrect handling of url fragment identifiers flaw was found in the Blink component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=758523
External References:
https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
Discussion:
Created chromium tracking bugs for this issue:
Affects: fedora-all [bug 1552502]
Affects: epel-7 [bug 1552504]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6 Supplementary
Via RHSA-2018:0484 https://access.redhat.com/errata/RHSA-2018:0484
http://www.securityfocus.com/bid/103297https://access.redhat.com/errata/RHSA-2018:0484https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.htmlhttps://crbug.com/758523https://www.debian.org/security/2018/dsa-4182http://www.securityfocus.com/bid/103297https://access.redhat.com/errata/RHSA-2018:0484https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.htmlhttps://crbug.com/758523https://www.debian.org/security/2018/dsa-4182
2018-11-14
Published