CVE-2018-18356

Name	CVE-2018-18356
Description	An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1677-1, DLA-1678-1, DSA-4352-1, DSA-4391-1, DSA-4392-1
Debian Bugs	818180

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
chromium (PTS)	stretch (security), stretch (lts), stretch	73.0.3683.75-1~deb9u1	fixed
	buster (security), buster, buster (lts)	90.0.4430.212-1~deb10u1	fixed
	bullseye (security), bullseye	120.0.6099.224-1~deb11u1	fixed
	bookworm	130.0.6723.91-1~deb12u1	fixed
	bookworm (security)	131.0.6778.204-1~deb12u1	fixed
	trixie	131.0.6778.139-1	fixed
	sid	131.0.6778.204-1	fixed
chromium-browser (PTS)	stretch (security), stretch (lts), stretch	71.0.3578.80-1~deb9u1	fixed
firefox (PTS)	sid	133.0.3-1	fixed
firefox-esr (PTS)	jessie, jessie (lts)	68.9.0esr-1~deb8u2	fixed
	stretch (security), stretch (lts), stretch	91.11.0esr-1~deb9u1	fixed
	buster (security), buster, buster (lts)	115.12.0esr-1~deb10u1	fixed
	bullseye	115.14.0esr-1~deb11u1	fixed
	bullseye (security)	128.5.0esr-1~deb11u1	fixed
	bookworm	128.3.1esr-1~deb12u1	fixed
	bookworm (security)	128.5.0esr-1~deb12u1	fixed
	trixie	128.5.0esr-1	fixed
	sid	128.5.1esr-1	fixed
thunderbird (PTS)	jessie, jessie (lts)	1:68.9.0-1~deb8u2	fixed
	stretch (security), stretch (lts), stretch	1:91.10.0-1~deb9u1	fixed
	buster (security), buster, buster (lts)	1:115.12.0-1~deb10u1	fixed
	bullseye	1:115.12.0-1~deb11u1	fixed
	bullseye (security)	1:128.5.0esr-1~deb11u1	fixed
	bookworm	1:115.16.0esr-1~deb12u1	fixed
	bookworm (security)	1:128.5.0esr-1~deb12u1	fixed
	sid, trixie	1:128.5.2esr-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
chromium	source	(unstable)	71.0.3578.80-1
chromium-browser	source	stretch	71.0.3578.80-1~deb9u1	DSA-4352-1
firefox	source	(unstable)	65.0.1-1
firefox-esr	source	jessie	60.5.1esr-1~deb8u1	DLA-1677-1
firefox-esr	source	stretch	60.5.1esr-1~deb9u1	DSA-4391-1
firefox-esr	source	(unstable)	60.5.1esr-1
skia	ITP				818180
thunderbird	source	jessie	1:60.5.1-1~deb8u1	DLA-1678-1
thunderbird	source	stretch	1:60.5.1-1~deb9u1	DSA-4392-1
thunderbird	source	(unstable)	1:60.5.1-1

Notes

https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/#CVE-2018-18356
https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/#CVE-2018-18356
https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/#CVE-2018-18356