A missing origin check related to HLS manifests in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass same origin policy via a crafted HTML page.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A missing origin check related to HLS manifests in Blink in Google Chrome prior to 69.0.3497.81 allowed a     remote attacker to bypass same origin policy via a crafted HTML page. (CVE-2018-16072)

Note that Nessus relies on the presence of the package as reported by the vendor.

Security fixes for CVE-2018-6055 CVE-2018-6119 CVE-2018-16429 CVE-2018-16428

----

Update to Chromium 69. (EPEL-7 update is blocked by a GCC bug:
1629813, so as soon as devtoolset-8 arrives...)

Fixes a lot of security issues, like every major release of Chromium, including CVE-2018-16087 CVE-2018-16088 CVE-2018-16086CVE-2018-16065 CVE-2018-16066 CVE-2018-16067 CVE-2018-16068 CVE-2018-16069 CVE-2018-16070 CVE-2018-16071 CVE-2018-16072 CVE-2018-16073 CVE-2018-16074 CVE-2018-16075 CVE-2018-16076 CVE-2018-16077 CVE-2018-16078

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Chromium 69. (EPEL-7 update is blocked by a GCC bug:
1629813, so as soon as devtoolset-8 arrives...)

Fixes a lot of security issues, like every major release of Chromium, including CVE-2018-16087 CVE-2018-16088 CVE-2018-16086CVE-2018-16065 CVE-2018-16066 CVE-2018-16067 CVE-2018-16068 CVE-2018-16069 CVE-2018-16070 CVE-2018-16071 CVE-2018-16072 CVE-2018-16073 CVE-2018-16074 CVE-2018-16075 CVE-2018-16076 CVE-2018-16077 CVE-2018-16078

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201811-10 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the referenced CVE identifiers and Google Chrome       Releases for details.
  Impact :

    A remote attacker could execute arbitrary code, escalate privileges,       cause a heap buffer overflow, obtain sensitive information, or spoof a       URL.
  Workaround :

    There is no known workaround at this time.

The remote Fedora 27 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2018-4a16e37c81 advisory.

    Update to Chromium 69. (EPEL-7 update is blocked by a GCC bug: 1629813, so as soon as devtoolset-8     arrives...)

    Fixes a lot of security issues, like every major release of Chromium, including     CVE-2018-16087 CVE-2018-16088 CVE-2018-16086CVE-2018-16065 CVE-2018-16066 CVE-2018-16067 CVE-2018-16068     CVE-2018-16069 CVE-2018-16070 CVE-2018-16071 CVE-2018-16072 CVE-2018-16073     CVE-2018-16074 CVE-2018-16075 CVE-2018-16076 CVE-2018-16077 CVE-2018-16078

    ----

    Update to Chromium 68.
    Security fix for  CVE-2018-4117 CVE-2018-6044 CVE-2018-6150 CVE-2018-6151 CVE-2018-6152 CVE-2018-6153     CVE-2018-6154 CVE-2018-6155 CVE-2018-6156 CVE-2018-6157 CVE-2018-6158 CVE-2018-6159 CVE-2018-6161     CVE-2018-6162 CVE-2018-6163 CVE-2018-6149

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 69.0.3497.81. It is, therefore, affected by multiple vulnerabilities as noted in Google Chrome stable channel update release notes for 2018/09/04. Please refer to the release notes for additional information. Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self- reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 69.0.3497.81. It is, therefore, affected by multiple vulnerabilities as noted in Google Chrome stable channel update release notes for 2018/09/04. Please refer to the release notes for additional information. Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self- reported version number.

ID	Name	Product	Family	Severity
261071	Linux Distros Unpatched Vulnerability : CVE-2018-16072	Nessus	Misc.	medium
120356	Fedora 29 : chromium (2018-39be36e9fc)	Nessus	Fedora Local Security Checks	critical
120245	Fedora 28 : chromium (2018-13d8c35127)	Nessus	Fedora Local Security Checks	critical
119130	GLSA-201811-10 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
117647	Fedora 27 : chromium (2018-4a16e37c81)	Nessus	Fedora Local Security Checks	critical
117333	Google Chrome < 69.0.3497.81 Multiple Vulnerabilities	Nessus	Windows	critical
117332	Google Chrome < 69.0.3497.81 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2018-16072

medium

Tenable Plugins

medium

critical

critical

critical

critical

critical

critical