Incorrect handling of clicks in the omnibox in Navigation in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Incorrect handling of clicks in the omnibox in Navigation in Google Chrome prior to 69.0.3497.92 allowed a     remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2018-17459)

Note that Nessus relies on the presence of the package as reported by the vendor.

Security fixes for CVE-2018-6055 CVE-2018-6119 CVE-2018-16429 CVE-2018-16428

----

Update to Chromium 69. (EPEL-7 update is blocked by a GCC bug:
1629813, so as soon as devtoolset-8 arrives...)

Fixes a lot of security issues, like every major release of Chromium, including CVE-2018-16087 CVE-2018-16088 CVE-2018-16086CVE-2018-16065 CVE-2018-16066 CVE-2018-16067 CVE-2018-16068 CVE-2018-16069 CVE-2018-16070 CVE-2018-16071 CVE-2018-16072 CVE-2018-16073 CVE-2018-16074 CVE-2018-16075 CVE-2018-16076 CVE-2018-16077 CVE-2018-16078

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Chromium 69. (EPEL-7 update is blocked by a GCC bug:
1629813, so as soon as devtoolset-8 arrives...)

Fixes a lot of security issues, like every major release of Chromium, including CVE-2018-16087 CVE-2018-16088 CVE-2018-16086CVE-2018-16065 CVE-2018-16066 CVE-2018-16067 CVE-2018-16068 CVE-2018-16069 CVE-2018-16070 CVE-2018-16071 CVE-2018-16072 CVE-2018-16073 CVE-2018-16074 CVE-2018-16075 CVE-2018-16076 CVE-2018-16077 CVE-2018-16078

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:2818 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 69.0.3497.100.

    Security Fix(es):

    * chromium-browser: Function signature mismatch in WebAssembly (CVE-2018-17458)

    * chromium-browser: URL Spoofing in Omnibox (CVE-2018-17459)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 27 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2018-4a16e37c81 advisory.

    Update to Chromium 69. (EPEL-7 update is blocked by a GCC bug: 1629813, so as soon as devtoolset-8     arrives...)

    Fixes a lot of security issues, like every major release of Chromium, including     CVE-2018-16087 CVE-2018-16088 CVE-2018-16086CVE-2018-16065 CVE-2018-16066 CVE-2018-16067 CVE-2018-16068     CVE-2018-16069 CVE-2018-16070 CVE-2018-16071 CVE-2018-16072 CVE-2018-16073     CVE-2018-16074 CVE-2018-16075 CVE-2018-16076 CVE-2018-16077 CVE-2018-16078

    ----

    Update to Chromium 68.
    Security fix for  CVE-2018-4117 CVE-2018-6044 CVE-2018-6150 CVE-2018-6151 CVE-2018-6152 CVE-2018-6153     CVE-2018-6154 CVE-2018-6155 CVE-2018-6156 CVE-2018-6157 CVE-2018-6158 CVE-2018-6159 CVE-2018-6161     CVE-2018-6162 CVE-2018-6163 CVE-2018-6149

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote host is prior to 69.0.3497.92. It is, therefore, affected by multiple vulnerabilities as referenced in the Google Chrome stable channel update release notes for 2018/09/11.

- An improper update of the WebAssembly dispatch table in WebAssembly in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page (CVE-2018-17458).

- Incorrect handling of clicks in the omnibox in Navigation in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page (CVE-2018-17459).

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 69.0.3497.92. It is, therefore, affected by a vulnerability as noted in Google Chrome stable channel update release notes for 2018/09/11. Please refer to the release notes for additional information. Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
251681	Linux Distros Unpatched Vulnerability : CVE-2018-17459	Nessus	Misc.	medium
120356	Fedora 29 : chromium (2018-39be36e9fc)	Nessus	Fedora Local Security Checks	critical
120245	Fedora 28 : chromium (2018-13d8c35127)	Nessus	Fedora Local Security Checks	critical
117784	RHEL 6 : chromium-browser (RHSA-2018:2818)	Nessus	Red Hat Local Security Checks	high
117647	Fedora 27 : chromium (2018-4a16e37c81)	Nessus	Fedora Local Security Checks	critical
117429	Google Chrome < 69.0.3497.92 Vulnerability	Nessus	Windows	high
117428	Google Chrome < 69.0.3497.92 Vulnerability	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2018-17459

medium

Tenable Plugins

medium

critical

critical

high

critical

high

high