A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to     execute arbitrary code inside a sandbox via a crafted HTML page. (CVE-2018-6087)

Note that Nessus relies on the presence of the package as reported by the vendor.

Update to 66.0.3359.181. Security fix for CVE-2018-6085 CVE-2018-6086 CVE-2018-6087 CVE-2018-6088 CVE-2018-6089 CVE-2018-6090 CVE-2018-6091 CVE-2018-6092 CVE-2018-6093 CVE-2018-6094 CVE-2018-6095 CVE-2018-6096 CVE-2018-6097 CVE-2018-6098 CVE-2018-6099 CVE-2018-6100 CVE-2018-6101 CVE-2018-6102 CVE-2018-6103 CVE-2018-6104 CVE-2018-6105 CVE-2018-6106 CVE-2018-6107 CVE-2018-6108 CVE-2018-6109 CVE-2018-6110 CVE-2018-6111 CVE-2018-6112 CVE-2018-6113 CVE-2018-6114 CVE-2018-6116 CVE-2018-6117 CVE-2018-6118 CVE-2018-6121 CVE-2018-6122 CVE-2018-6120

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2018-6056     lokihardt discovered an error in the v8 JavaScript     library.

  - CVE-2018-6057     Gal Beniamini discovered errors related to shared memory     permissions.

  - CVE-2018-6060     Omair discovered a use-after-free issue in blink/webkit.

  - CVE-2018-6061     Guang Gong discovered a race condition in the v8     JavaScript library.

  - CVE-2018-6062     A heap overflow issue was discovered in the v8     JavaScript library.

  - CVE-2018-6063     Gal Beniamini discovered errors related to shared memory     permissions.

  - CVE-2018-6064     lokihardt discovered a type confusion error in the v8     JavaScript library.

  - CVE-2018-6065     Mark Brand discovered an integer overflow issue in the     v8 JavaScript library.

  - CVE-2018-6066     Masato Kinugawa discovered a way to bypass the Same     Origin Policy.

  - CVE-2018-6067     Ned Williamson discovered a buffer overflow issue in the     skia library.

  - CVE-2018-6068     Luan Herrera discovered object lifecycle issues.

  - CVE-2018-6069     Wanglu and Yangkang discovered a stack overflow issue in     the skia library.

  - CVE-2018-6070     Rob Wu discovered a way to bypass the Content Security     Policy.

  - CVE-2018-6071     A heap overflow issue was discovered in the skia     library.

  - CVE-2018-6072     Atte Kettunen discovered an integer overflow issue in     the pdfium library.

  - CVE-2018-6073     Omair discover a heap overflow issue in the WebGL     implementation.

  - CVE-2018-6074     Abdulrahman Alqabandi discovered a way to cause a     downloaded web page to not contain a Mark of the Web.

  - CVE-2018-6075     Inti De Ceukelaire discovered a way to bypass the Same     Origin Policy.

  - CVE-2018-6076     Mateusz Krzeszowiec discovered that URL fragment     identifiers could be handled incorrectly.

  - CVE-2018-6077     Khalil Zhani discovered a timing issue.

  - CVE-2018-6078     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6079     Ivars discovered an information disclosure issue.

  - CVE-2018-6080     Gal Beniamini discovered an information disclosure     issue.

  - CVE-2018-6081     Rob Wu discovered a cross-site scripting issue.

  - CVE-2018-6082     WenXu Wu discovered a way to bypass blocked ports.

  - CVE-2018-6083     Jun Kokatsu discovered that AppManifests could be     handled incorrectly.

  - CVE-2018-6085     Ned Williamson discovered a use-after-free issue.

  - CVE-2018-6086     Ned Williamson discovered a use-after-free issue.

  - CVE-2018-6087     A use-after-free issue was discovered in the WebAssembly     implementation.

  - CVE-2018-6088     A use-after-free issue was discovered in the pdfium     library.

  - CVE-2018-6089     Rob Wu discovered a way to bypass the Same Origin     Policy.

  - CVE-2018-6090     ZhanJia Song discovered a heap overflow issue in the     skia library.

  - CVE-2018-6091     Jun Kokatsu discovered that plugins could be handled     incorrectly.

  - CVE-2018-6092     Natalie Silvanovich discovered an integer overflow issue     in the WebAssembly implementation.

  - CVE-2018-6093     Jun Kokatsu discovered a way to bypass the Same Origin     Policy.

  - CVE-2018-6094     Chris Rohlf discovered a regression in garbage     collection hardening.

  - CVE-2018-6095     Abdulrahman Alqabandi discovered files could be uploaded     without user interaction.

  - CVE-2018-6096     WenXu Wu discovered a user interface spoofing issue.

  - CVE-2018-6097     xisigr discovered a user interface spoofing issue.

  - CVE-2018-6098     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6099     Jun Kokatsu discovered a way to bypass the Cross Origin     Resource Sharing mechanism.

  - CVE-2018-6100     Lnyas Zhang discovered a URL spoofing issue.

  - CVE-2018-6101     Rob Wu discovered an issue in the developer tools remote     debugging protocol.

  - CVE-2018-6102     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6103     Khalil Zhani discovered a user interface spoofing issue.

  - CVE-2018-6104     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6105     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6106     lokihardt discovered that v8 promises could be handled     incorrectly.

  - CVE-2018-6107     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6108     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6109     Dominik Weber discovered a way to misuse the FileAPI     feature.

  - CVE-2018-6110     Wenxiang Qian discovered that local plain text files     could be handled incorrectly.

  - CVE-2018-6111     Khalil Zhani discovered a use-after-free issue in the     developer tools.

  - CVE-2018-6112     Khalil Zhani discovered incorrect handling of URLs in     the developer tools.

  - CVE-2018-6113     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6114     Lnyas Zhang discovered a way to bypass the Content     Security Policy.

  - CVE-2018-6116     Chengdu Security Response Center discovered an error     when memory is low.

  - CVE-2018-6117     Spencer Dailey discovered an error in form autofill     settings.

The version of Google Chrome installed on the remote macOS host is prior to 66.0.3359.117. It is, therefore, affected by multiple vulnerabilities as referenced in the 2018_04_stable-channel-update-for-desktop advisory.

  - Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117     allowed a local attacker to execute arbitrary code via an executable file. (CVE-2018-6084)

  - The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe,     regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinced a user     to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page and user     interaction. (CVE-2018-6152)

  - Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote     attacker to execute arbitrary code via a crafted HTML page. (CVE-2018-6085)

  - A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in     Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted     HTML page. (CVE-2018-6086)

  - A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to     execute arbitrary code inside a sandbox via a crafted HTML page. (CVE-2018-6087)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 66.0.3359.117. It is, therefore, affected by multiple vulnerabilities as referenced in the 2018_04_stable-channel-update-for-desktop advisory.

  - Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117     allowed a local attacker to execute arbitrary code via an executable file. (CVE-2018-6084)

  - The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe,     regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinced a user     to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page and user     interaction. (CVE-2018-6152)

  - Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote     attacker to execute arbitrary code via a crafted HTML page. (CVE-2018-6085)

  - A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in     Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted     HTML page. (CVE-2018-6086)

  - A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to     execute arbitrary code inside a sandbox via a crafted HTML page. (CVE-2018-6087)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Google Chrome Releases reports :

62 security fixes in this release :

- [826626] Critical CVE-2018-6085: Use after free in Disk Cache.
Reported by Ned Williamson on 2018-03-28

- [827492] Critical CVE-2018-6086: Use after free in Disk Cache.
Reported by Ned Williamson on 2018-03-30

- [813876] High CVE-2018-6087: Use after free in WebAssembly. Reported by Anonymous on 2018-02-20

- [822091] High CVE-2018-6088: Use after free in PDFium. Reported by Anonymous on 2018-03-15

- [808838] High CVE-2018-6089: Same origin policy bypass in Service Worker. Reported by Rob Wu on 2018-02-04

- [820913] High CVE-2018-6090: Heap buffer overflow in Skia. Reported by ZhanJia Song on 2018-03-12

- [771933] High CVE-2018-6091: Incorrect handling of plug-ins by Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-10-05

- [819869] High CVE-2018-6092: Integer overflow in WebAssembly.
Reported by Natalie Silvanovich of Google Project Zero on 2018-03-08

- [780435] Medium CVE-2018-6093: Same origin bypass in Service Worker.
Reported by Jun Kokatsu (@shhnjk) on 2017-11-01

- [633030] Medium CVE-2018-6094: Exploit hardening regression in Oilpan. Reported by Chris Rohlf on 2016-08-01

- [637098] Medium CVE-2018-6095: Lack of meaningful user interaction requirement before file upload. Reported by Abdulrahman Alqabandi (@qab) on 2016-08-11

- [776418] Medium CVE-2018-6096: Fullscreen UI spoof. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-19

- [806162] Medium CVE-2018-6097: Fullscreen UI spoof. Reported by xisigr of Tencent's Xuanwu Lab on 2018-01-26

- [798892] Medium CVE-2018-6098: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-03

- [808825] Medium CVE-2018-6099: CORS bypass in ServiceWorker.
Reported by Jun Kokatsu (@shhnjk) on 2018-02-03

- [811117] Medium CVE-2018-6100: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-02-11

- [813540] Medium CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools . Reported by Rob Wu on 2018-02-19

- [813814] Medium CVE-2018-6102: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-20

- [816033] Medium CVE-2018-6103: UI spoof in Permissions. Reported by Khalil Zhani on 2018-02-24

- [820068] Medium CVE-2018-6104: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-08

- [803571] Medium CVE-2018-6105: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-18

- [805729] Medium CVE-2018-6106: Incorrect handling of promises in V8.
Reported by lokihardt of Google Project Zero on 2018-01-25

- [808316] Medium CVE-2018-6107: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-02

- [816769] Medium CVE-2018-6108: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-27

- [710190] Low CVE-2018-6109: Incorrect handling of files by FileAPI.
Reported by Dominik Weber (@DoWeb_) on 2017-04-10

- [777737] Low CVE-2018-6110: Incorrect handling of plaintext files via file:// . Reported by Wenxiang Qian (aka blastxiang) on 2017-10-24

- [780694] Low CVE-2018-6111: Heap-use-after-free in DevTools.
Reported by Khalil Zhani on 2017-11-02

- [798096] Low CVE-2018-6112: Incorrect URL handling in DevTools.
Reported by Rob Wu on 2017-12-29

- [805900] Low CVE-2018-6113: URL spoof in Navigation. Reported by Khalil Zhani on 2018-01-25

- [811691] Low CVE-2018-6114: CSP bypass. Reported by Lnyas Zhang on 2018-02-13

- [819809] Low CVE-2018-6115: SmartScreen bypass in downloads.
Reported by James Feher on 2018-03-07

- [822266] Low CVE-2018-6116: Incorrect low memory handling in WebAssembly. Reported by Jin from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. on 2018-03-15

- [822465] Low CVE-2018-6117: Confusing autofill settings. Reported by Spencer Dailey on 2018-03-15

- [822424] Low CVE-2018-6084: Incorrect use of Distributed Objects in Google Software Updater on MacOS. Reported by Ian Beer of Google Project Zero on 2018-03-15

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:1195 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 66.0.3359.117.

    Security Fix(es):

    * chromium-browser: Use after free in Disk Cache (CVE-2018-6085)

    * chromium-browser: Use after free in Disk Cache (CVE-2018-6086)

    * chromium-browser: Use after free in WebAssembly (CVE-2018-6087)

    * chromium-browser: Use after free in PDFium (CVE-2018-6088)

    * chromium-browser: Same origin policy bypass in Service Worker (CVE-2018-6089)

    * chromium-browser: Heap buffer overflow in Skia (CVE-2018-6090)

    * chromium-browser: Incorrect handling of plug-ins by Service Worker (CVE-2018-6091)

    * chromium-browser: Integer overflow in WebAssembly (CVE-2018-6092)

    * chromium-browser: Same origin bypass in Service Worker (CVE-2018-6093)

    * chromium-browser: Exploit hardening regression in Oilpan (CVE-2018-6094)

    * chromium-browser: Lack of meaningful user interaction requirement before file upload (CVE-2018-6095)

    * chromium-browser: Fullscreen UI spoof (CVE-2018-6096)

    * chromium-browser: Fullscreen UI spoof (CVE-2018-6097)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-6098)

    * chromium-browser: CORS bypass in ServiceWorker (CVE-2018-6099)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-6100)

    * chromium-browser: Insufficient protection of remote debugging prototol in DevTools (CVE-2018-6101)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-6102)

    * chromium-browser: UI spoof in Permissions (CVE-2018-6103)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-6104)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-6105)

    * chromium-browser: Incorrect handling of promises in V8 (CVE-2018-6106)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-6107)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-6108)

    * chromium-browser: Incorrect handling of files by FileAPI (CVE-2018-6109)

    * chromium-browser: Incorrect handling of plaintext files via file:// (CVE-2018-6110)

    * chromium-browser: Heap-use-after-free in DevTools (CVE-2018-6111)

    * chromium-browser: Incorrect URL handling in DevTools (CVE-2018-6112)

    * chromium-browser: URL spoof in Navigation (CVE-2018-6113)

    * chromium-browser: CSP bypass (CVE-2018-6114)

    * chromium-browser: Incorrect low memory handling in WebAssembly (CVE-2018-6116)

    * chromium-browser: Confusing autofill settings (CVE-2018-6117)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201804-22 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the referenced CVE identifiers and Google Chrome       Releases for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, bypass       content security controls, or conduct URL spoofing.
  Workaround :

    There is no known workaround at this time.

This update for Chromium to version 66.0.3359.117 fixes the following issues :

Security issues fixed (boo#1090000) :

  - CVE-2018-6085: Use after free in Disk Cache

  - CVE-2018-6086: Use after free in Disk Cache

  - CVE-2018-6087: Use after free in WebAssembly

  - CVE-2018-6088: Use after free in PDFium

  - CVE-2018-6089: Same origin policy bypass in Service     Worker

  - CVE-2018-6090: Heap buffer overflow in Skia

  - CVE-2018-6091: Incorrect handling of plug-ins by Service     Worker

  - CVE-2018-6092: Integer overflow in WebAssembly

  - CVE-2018-6093: Same origin bypass in Service Worker

  - CVE-2018-6094: Exploit hardening regression in Oilpan

  - CVE-2018-6095: Lack of meaningful user interaction     requirement before file upload

  - CVE-2018-6096: Fullscreen UI spoof

  - CVE-2018-6097: Fullscreen UI spoof

  - CVE-2018-6098: URL spoof in Omnibox

  - CVE-2018-6099: CORS bypass in ServiceWorker

  - CVE-2018-6100: URL spoof in Omnibox

  - CVE-2018-6101: Insufficient protection of remote     debugging prototol in DevTools 

  - CVE-2018-6102: URL spoof in Omnibox

  - CVE-2018-6103: UI spoof in Permissions

  - CVE-2018-6104: URL spoof in Omnibox

  - CVE-2018-6105: URL spoof in Omnibox

  - CVE-2018-6106: Incorrect handling of promises in V8

  - CVE-2018-6107: URL spoof in Omnibox

  - CVE-2018-6108: URL spoof in Omnibox

  - CVE-2018-6109: Incorrect handling of files by FileAPI

  - CVE-2018-6110: Incorrect handling of plaintext files via     file:// 

  - CVE-2018-6111: Heap-use-after-free in DevTools

  - CVE-2018-6112: Incorrect URL handling in DevTools

  - CVE-2018-6113: URL spoof in Navigation

  - CVE-2018-6114: CSP bypass

  - CVE-2018-6115: SmartScreen bypass in downloads

  - CVE-2018-6116: Incorrect low memory handling in     WebAssembly

  - CVE-2018-6117: Confusing autofill settings

  - Various fixes from internal audits, fuzzing and other     initiatives This update also supports mitigation against     the Spectre vulnerabilities: 'Strict site isolation' is     disabled for most users and can be turned on via:
    chrome://flags/#enable-site-per-process This feature is     undergoing a small percentage trial. Out out of the     trial is possible via:
    chrome://flags/#site-isolation-trial-opt-out

The following other changes are included :

  - distrust certificates issued by Symantec before     2016-06-01

  - add option to export saved passwords

  - Reduce videos that auto-play with sound

  - boo#1086199: Fix UI freezing when loading/scaling down     large images

This update also contains a number of upstream bug fixes and improvements.

ID	Name	Product	Family	Type	Severity
251814	Linux Distros Unpatched Vulnerability : CVE-2018-6087	Nessus	Misc.	Local	high
120630	Fedora 28 : chromium (2018-94e1bc8c23)	Nessus	Fedora Local Security Checks	Local	high
110327	Fedora 27 : chromium (2018-812b5d5a71)	Nessus	Fedora Local Security Checks	Local	high
109411	Debian DSA-4182-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	Local	high
109396	Google Chrome < 66.0.3359.117 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	critical
109395	Google Chrome < 66.0.3359.117 Multiple Vulnerabilities	Nessus	Windows	Local	critical
109330	FreeBSD : chromium -- vulnerability (36ff7a74-47b1-11e8-a7d6-54e1ad544088)	Nessus	FreeBSD Local Security Checks	Local	high
109299	RHEL 6 : chromium-browser (RHSA-2018:1195)	Nessus	Red Hat Local Security Checks	Local	high
109290	GLSA-201804-22 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
109236	openSUSE Security Update : chromium (openSUSE-2018-381)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2018-6087

high

Tenable Plugins

high

high

high

high

critical

critical

high

high

high

high