{
  "fix": "chromium-codecs-ffmpeg 71.0.3578.80-0ubuntu0.18.04.1",
  "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-chromium-codecs-ffmpeg-71.0.3578.80-0ubuntu0.18.04.1",
  "summary": "chromium-codecs-ffmpeg 71.0.3578.80-0ubuntu0.18.04.1, released December 11, 2018, fixes 27 CVEs in chromium-codecs-ffmpeg. One of them is being exploited (CVE-2018-17480); 1 on CISA KEV. Patch Radar priority: Patch now. The product is no longer supported.",
  "platform": "linux",
  "type": "package",
  "title": "chromium-codecs-ffmpeg 71.0.3578.80-0ubuntu0.18.04.1 for Ubuntu 18.04.6 LTS (bionic)",
  "released": "2018-12-11T08:29:00Z",
  "priority": "Patch now",
  "priorityTier": 1,
  "priorityReason": "Closes CVE-2018-17480, exploited (CISA KEV)",
  "supported": false,
  "cveCount": 27,
  "exploitedCveCount": 1,
  "kevCveCount": 1,
  "ransomwareCveCount": 0,
  "maxEpss": 0.3564,
  "maxCvss": 8.8,
  "appliesTo": [
    {
      "product": "chromium-codecs-ffmpeg",
      "productUrl": "https://patchblox.com/security/product/linux/chromium-codecs-ffmpeg",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "71.0.3578.80-0ubuntu0.18.04.1",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2018-17480",
      "url": "https://patchblox.com/security/cve/CVE-2018-17480",
      "title": "chromium-browser: Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google...",
      "priority": "Patch now",
      "severity": "Medium",
      "epss": 0.3564,
      "kev": true,
      "ransomware": false,
      "exploited": true,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18356",
      "url": "https://patchblox.com/security/cve/CVE-2018-18356",
      "title": "chromium-browser: An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed...",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.03277,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18335",
      "url": "https://patchblox.com/security/cve/CVE-2018-18335",
      "title": "chromium-browser: Heap buffer overflow in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.03898,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18342",
      "url": "https://patchblox.com/security/cve/CVE-2018-18342",
      "title": "chromium-browser: Execution of user supplied Javascript during object deserialization can update object length leading to an out of bou...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02653,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18351",
      "url": "https://patchblox.com/security/cve/CVE-2018-18351",
      "title": "chromium-browser: Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.0255,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18337",
      "url": "https://patchblox.com/security/cve/CVE-2018-18337",
      "title": "chromium-browser: Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01677,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-17481",
      "url": "https://patchblox.com/security/cve/CVE-2018-17481",
      "title": "chromium-browser: Incorrect object lifecycle handling in PDFium in Google Chrome prior to 71.0.3578.98 allowed a remote attacker to pot...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01606,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18336",
      "url": "https://patchblox.com/security/cve/CVE-2018-18336",
      "title": "chromium-browser: Incorrect object lifecycle in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01534,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18344",
      "url": "https://patchblox.com/security/cve/CVE-2018-18344",
      "title": "chromium-browser: Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01498,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18341",
      "url": "https://patchblox.com/security/cve/CVE-2018-18341",
      "title": "chromium-browser: An integer overflow leading to a heap buffer overflow in Blink in Google Chrome prior to 71.0.3578.80 allowed a remot...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01468,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18345",
      "url": "https://patchblox.com/security/cve/CVE-2018-18345",
      "title": "chromium-browser: Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker wh...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01445,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18338",
      "url": "https://patchblox.com/security/cve/CVE-2018-18338",
      "title": "chromium-browser: Incorrect, thread-unsafe use of SkImage in Canvas in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01424,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18339",
      "url": "https://patchblox.com/security/cve/CVE-2018-18339",
      "title": "chromium-browser: Incorrect object lifecycle in WebAudio in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentiall...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01424,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18354",
      "url": "https://patchblox.com/security/cve/CVE-2018-18354",
      "title": "chromium-browser: Insufficient validate of external protocols in Shell Integration in Google Chrome on Windows prior to 71.0.3578.80 al...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01424,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18359",
      "url": "https://patchblox.com/security/cve/CVE-2018-18359",
      "title": "chromium-browser: Incorrect handling of Reflect.construct in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to per...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01413,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18352",
      "url": "https://patchblox.com/security/cve/CVE-2018-18352",
      "title": "chromium-browser: Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01391,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18340",
      "url": "https://patchblox.com/security/cve/CVE-2018-18340",
      "title": "chromium-browser: Incorrect object lifecycle in MediaRecorder in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to poten...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01386,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18347",
      "url": "https://patchblox.com/security/cve/CVE-2018-18347",
      "title": "chromium-browser: Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allow...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01386,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18343",
      "url": "https://patchblox.com/security/cve/CVE-2018-18343",
      "title": "chromium-browser: Incorrect handing of paths leading to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remot...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01384,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18350",
      "url": "https://patchblox.com/security/cve/CVE-2018-18350",
      "title": "chromium-browser: Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a re...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01376,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18353",
      "url": "https://patchblox.com/security/cve/CVE-2018-18353",
      "title": "chromium-browser: Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71....",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01372,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18346",
      "url": "https://patchblox.com/security/cve/CVE-2018-18346",
      "title": "chromium-browser: Incorrect handling of alert box display in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01331,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18355",
      "url": "https://patchblox.com/security/cve/CVE-2018-18355",
      "title": "chromium-browser: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01145,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18357",
      "url": "https://patchblox.com/security/cve/CVE-2018-18357",
      "title": "chromium-browser: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01145,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18348",
      "url": "https://patchblox.com/security/cve/CVE-2018-18348",
      "title": "chromium-browser: Incorrect handling of bidirectional domain names with RTL characters in Omnibox in Google Chrome prior to 71.0.3578.8...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01114,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18349",
      "url": "https://patchblox.com/security/cve/CVE-2018-18349",
      "title": "chromium-browser: Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00976,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-18358",
      "url": "https://patchblox.com/security/cve/CVE-2018-18358",
      "title": "chromium-browser: Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the l...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00443,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-12T19:57:06Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}