Incorrect URL parsing in WebKit in Google Chrome on iOS prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via a crafted HTML page.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Incorrect URL parsing in WebKit in Google Chrome on iOS prior to 67.0.3396.62 allowed a remote attacker to     perform domain spoofing via a crafted HTML page. (CVE-2018-6128)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for Chromium to version 67.0.3396.99 fixes multiple issues.

Security issues fixed (bsc#1095163) :

  - CVE-2018-6123: Use after free in Blink

  - CVE-2018-6124: Type confusion in Blink

  - CVE-2018-6125: Overly permissive policy in WebUSB

  - CVE-2018-6126: Heap buffer overflow in Skia

  - CVE-2018-6127: Use after free in indexedDB

  - CVE-2018-6129: Out of bounds memory access in WebRTC

  - CVE-2018-6130: Out of bounds memory access in WebRTC

  - CVE-2018-6131: Incorrect mutability protection in     WebAssembly

  - CVE-2018-6132: Use of uninitialized memory in WebRTC

  - CVE-2018-6133: URL spoof in Omnibox

  - CVE-2018-6134: Referrer Policy bypass in Blink

  - CVE-2018-6135: UI spoofing in Blink

  - CVE-2018-6136: Out of bounds memory access in V8

  - CVE-2018-6137: Leak of visited status of page in Blink

  - CVE-2018-6138: Overly permissive policy in Extensions

  - CVE-2018-6139: Restrictions bypass in the debugger     extension API

  - CVE-2018-6140: Restrictions bypass in the debugger     extension API

  - CVE-2018-6141: Heap buffer overflow in Skia

  - CVE-2018-6142: Out of bounds memory access in V8

  - CVE-2018-6143: Out of bounds memory access in V8

  - CVE-2018-6144: Out of bounds memory access in PDFium

  - CVE-2018-6145: Incorrect escaping of MathML in Blink

  - CVE-2018-6147: Password fields not taking advantage of     OS protections in Views

  - CVE-2018-6148: Incorrect handling of CSP header     (boo#1096508)

  - CVE-2018-6149: Out of bounds write in V8 (boo#1097452)

The following tracked packaging changes are included :

  - Require ffmpeg >= 4.0 (boo#1095545)

Update to Chromium 67. Security fix for CVE-2018-6123 CVE-2018-6124 CVE-2018-6125 CVE-2018-6126 CVE-2018-6127 CVE-2018-6128 CVE-2018-6129 CVE-2018-6130 CVE-2018-6131 CVE-2018-6132 CVE-2018-6133 CVE-2018-6134 CVE-2018-6135 CVE-2018-6136 CVE-2018-6137 CVE-2018-6148

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for chromium to version 66.0.3359.181 fixes the following issues :

The following security issues were fixed (boo#1095163) :

  - CVE-2018-6123: Use after free in Blink.

  - CVE-2018-6124: Type confusion in Blink.

  - CVE-2018-6125: Overly permissive policy in WebUSB.

  - CVE-2018-6126: Heap buffer overflow in Skia.

  - CVE-2018-6127: Use after free in indexedDB.

  - CVE-2018-6128: uXSS in Chrome on iOS.

  - CVE-2018-6129: Out of bounds memory access in WebRTC.

  - CVE-2018-6130: Out of bounds memory access in WebRTC.

  - CVE-2018-6131: Incorrect mutability protection in     WebAssembly.

  - CVE-2018-6132: Use of uninitialized memory in WebRTC.

  - CVE-2018-6133: URL spoof in Omnibox.

  - CVE-2018-6134: Referrer Policy bypass in Blink.

  - CVE-2018-6135: UI spoofing in Blink.

  - CVE-2018-6136: Out of bounds memory access in V8.

  - CVE-2018-6137: Leak of visited status of page in Blink.

  - CVE-2018-6138: Overly permissive policy in Extensions.

  - CVE-2018-6139: Restrictions bypass in the debugger     extension API.

  - CVE-2018-6140: Restrictions bypass in the debugger     extension API.

  - CVE-2018-6141: Heap buffer overflow in Skia.

  - CVE-2018-6142: Out of bounds memory access in V8.

  - CVE-2018-6143: Out of bounds memory access in V8.

  - CVE-2018-6144: Out of bounds memory access in PDFium.

  - CVE-2018-6145: Incorrect escaping of MathML in Blink.

  - CVE-2018-6147: Password fields not taking advantage of     OS protections in Views.

Additional changes :

  - Autoplay: Force enable on desktop for Web Audio This     update enables the 'Strict site isolation' feature for a     larger percentage of users. This feature is a mitigation     against the Spectre vulnerabilities. It can be turned on     via: chrome://flags/#enable-site-per-process It can be     disabled via:
    chrome://flags/#site-isolation-trial-opt-out

Google Chrome Releases reports :

34 security fixes in this release, including :

- [835639] High CVE-2018-6123: Use after free in Blink. Reported by Looben Yang on 2018-04-22

- [840320] High CVE-2018-6124: Type confusion in Blink. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-07

- [818592] High CVE-2018-6125: Overly permissive policy in WebUSB.
Reported by Yubico, Inc on 2018-03-05

- [844457] High CVE-2018-6126: Heap buffer overflow in Skia. Reported by Ivan Fratric of Google Project Zero on 2018-05-18

- [842990] High CVE-2018-6127: Use after free in indexedDB. Reported by Looben Yang on 2018-05-15

- [841105] High CVE-2018-6128: uXSS in Chrome on iOS. Reported by Tomasz Bojarski on 2018-05-09

- [838672] High CVE-2018-6129: Out of bounds memory access in WebRTC.
Reported by Natalie Silvanovich of Google Project Zero on 2018-05-01

- [838402] High CVE-2018-6130: Out of bounds memory access in WebRTC.
Reported by Natalie Silvanovich of Google Project Zero on 2018-04-30

- [826434] High CVE-2018-6131: Incorrect mutability protection in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-27

- [839960] Medium CVE-2018-6132: Use of uninitialized memory in WebRTC. Reported by Ronald E. Crane on 2018-05-04

- [817247] Medium CVE-2018-6133: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-28

- [797465] Medium CVE-2018-6134: Referrer Policy bypass in Blink.
Reported by Jun Kokatsu (@shhnjk) on 2017-12-23

- [823353] Medium CVE-2018-6135: UI spoofing in Blink. Reported by Jasper Rebane on 2018-03-19

- [831943] Medium CVE-2018-6136: Out of bounds memory access in V8.
Reported by Peter Wong on 2018-04-12

- [835589] Medium CVE-2018-6137: Leak of visited status of page in Blink. Reported by Michael Smith (spinda.net) on 2018-04-21

- [810220] Medium CVE-2018-6138: Overly permissive policy in Extensions. Reported by Francois Lajeunesse-Robert on 2018-02-08

- [805224] Medium CVE-2018-6139: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-24

- [798222] Medium CVE-2018-6140: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-01

- [796107] Medium CVE-2018-6141: Heap buffer overflow in Skia.
Reported by Yangkang (@dnpushme) and Wanglu of Qihoo360 Qex Team on 2017-12-19

- [837939] Medium CVE-2018-6142: Out of bounds memory access in V8.
Reported by Choongwoo Han of Naver Corporation on 2018-04-28

- [843022] Medium CVE-2018-6143: Out of bounds memory access in V8.
Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-15

- [828049] Low CVE-2018-6144: Out of bounds memory access in PDFium.
Reported by pdknsk on 2018-04-02

- [805924] Low CVE-2018-6145: Incorrect escaping of MathML in Blink.
Reported by Masato Kinugawa on 2018-01-25

- [818133] Low CVE-2018-6147: Password fields not taking advantage of OS protections in Views. Reported by Michail Pishchagin (Yandex) on 2018-03-02

- [847542] Various fixes from internal audits, fuzzing and other initiatives

The version of Google Chrome installed on the remote macOS host is prior to 67.0.3396.62. It is, therefore, affected by multiple vulnerabilities as referenced in the 2018_05_stable-channel-update-for-desktop_58 advisory.

  - Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to     67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute     arbitrary code via a crafted Chrome Extension. (CVE-2018-6140)

  - Early free of object in use in IndexDB in Google Chrome prior to 67.0.3396.62 allowed a remote attacker     who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2018-6127)

  - A use after free in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2018-6123)

  - Type confusion in ReadableStreams in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote     attacker to potentially exploit object corruption via a crafted HTML page. (CVE-2018-6124)

  - Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote     attacker to obtain potentially sensitive information via a crafted HTML page. (CVE-2018-6125)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 67.0.3396.62. It is, therefore, affected by multiple vulnerabilities as referenced in the 2018_05_stable-channel-update-for-desktop_58 advisory.

  - Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to     67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute     arbitrary code via a crafted Chrome Extension. (CVE-2018-6140)

  - Early free of object in use in IndexDB in Google Chrome prior to 67.0.3396.62 allowed a remote attacker     who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2018-6127)

  - A use after free in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2018-6123)

  - Type confusion in ReadableStreams in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote     attacker to potentially exploit object corruption via a crafted HTML page. (CVE-2018-6124)

  - Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote     attacker to obtain potentially sensitive information via a crafted HTML page. (CVE-2018-6125)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
260670	Linux Distros Unpatched Vulnerability : CVE-2018-6128	Nessus	Misc.	Local	medium
123234	openSUSE Security Update : Chromium (openSUSE-2019-548)	Nessus	SuSE Local Security Checks	Local	critical
120558	Fedora 28 : chromium (2018-7c80aaef26)	Nessus	Fedora Local Security Checks	Local	critical
111345	openSUSE Security Update : Chromium (openSUSE-2018-759)	Nessus	SuSE Local Security Checks	Local	critical
110625	Fedora 27 : chromium (2018-09b59b0227)	Nessus	Fedora Local Security Checks	Local	critical
110275	openSUSE Security Update : chromium (openSUSE-2018-546)	Nessus	SuSE Local Security Checks	Local	critical
110254	FreeBSD : chromium -- multiple vulnerabilities (427b0f58-644c-11e8-9e1b-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	Local	critical
110229	Google Chrome < 67.0.3396.62 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	critical
110228	Google Chrome < 67.0.3396.62 Multiple Vulnerabilities	Nessus	Windows	Local	critical

Detections

Analytics

CVE-2018-6128

medium

Tenable Plugins

medium

critical

critical

critical

critical

critical

critical

critical

critical