104309

1041014

RHSA-2018:1815

https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html

https://crbug.com/823353

DSA-4237

This update for Chromium to version 67.0.3396.99 fixes multiple issues.

Security issues fixed (bsc#1095163) :

  - CVE-2018-6123: Use after free in Blink

  - CVE-2018-6124: Type confusion in Blink

  - CVE-2018-6125: Overly permissive policy in WebUSB

  - CVE-2018-6126: Heap buffer overflow in Skia

  - CVE-2018-6127: Use after free in indexedDB

  - CVE-2018-6129: Out of bounds memory access in WebRTC

  - CVE-2018-6130: Out of bounds memory access in WebRTC

  - CVE-2018-6131: Incorrect mutability protection in     WebAssembly

  - CVE-2018-6132: Use of uninitialized memory in WebRTC

  - CVE-2018-6133: URL spoof in Omnibox

  - CVE-2018-6134: Referrer Policy bypass in Blink

  - CVE-2018-6135: UI spoofing in Blink

  - CVE-2018-6136: Out of bounds memory access in V8

  - CVE-2018-6137: Leak of visited status of page in Blink

  - CVE-2018-6138: Overly permissive policy in Extensions

  - CVE-2018-6139: Restrictions bypass in the debugger     extension API

  - CVE-2018-6140: Restrictions bypass in the debugger     extension API

  - CVE-2018-6141: Heap buffer overflow in Skia

  - CVE-2018-6142: Out of bounds memory access in V8

  - CVE-2018-6143: Out of bounds memory access in V8

  - CVE-2018-6144: Out of bounds memory access in PDFium

  - CVE-2018-6145: Incorrect escaping of MathML in Blink

  - CVE-2018-6147: Password fields not taking advantage of     OS protections in Views

  - CVE-2018-6148: Incorrect handling of CSP header     (boo#1096508)

  - CVE-2018-6149: Out of bounds write in V8 (boo#1097452)

The following tracked packaging changes are included :

  - Require ffmpeg >= 4.0 (boo#1095545)

Update to Chromium 67. Security fix for CVE-2018-6123 CVE-2018-6124 CVE-2018-6125 CVE-2018-6126 CVE-2018-6127 CVE-2018-6128 CVE-2018-6129 CVE-2018-6130 CVE-2018-6131 CVE-2018-6132 CVE-2018-6133 CVE-2018-6134 CVE-2018-6135 CVE-2018-6136 CVE-2018-6137 CVE-2018-6148

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Google Chrome installed on the remote host is prior to 67.0.3396.62, and is affected by multiple vulnerabilities :

 - A flaw exists in the 'SRIVerifier::DidGetReadable()' function in 'fetch/FetchManager.cpp' that is triggered when handling responses that are invalid for subresource integrity (SRI) validation. This may allow a context-dependent attacker to disclose cross-origin information.
 - An out-of-bounds read flaw exists in the 'Decode()' function in 'modules/audio_coding/codecs/isac/main/source/isac.c' that is triggered when decoding iSAC encoded content. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents.
 - A flaw exists that is triggered as secure text input is not enabled for password Textfields. This may allow a physically proximate attacker to potentially view entered passwords that are not being obfuscated.
 - An out-of-bounds read flaw exists in the 'CPDF_StreamParser::ParseNextElement()' function in 'core/fpdfapi/page/cpdf_streamparser.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose sensitive memory contents.
 - An overflow condition exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against the library or potentially allowing the execution of arbitrary code.
 - A flaw exists in the 'CSSPaintValue::GetImage()' function in 'blink/renderer/core/css/css_paint_value.cc'. This may allow a context-dependent attacker to disclose information about the page visited status.
 - A flaw exists in the 'RenderWidgetHostImpl::WasShown()' function in 'content/browser/renderer_host/render_widget_host_impl.cc'. This may allow a context-dependent attacker to spoof the user interface.
 - A flaw exists in the 'PerformanceNavigationTiming::PerformanceNavigationTiming()' function in 'third_party/WebKit/Source/core/timing/PerformanceNavigationTiming.cpp'. This may allow a context-dependent attacker to bypass the referrer policy.
 - A flaw exists as it does not properly limit certain problematic characters 'e.g'. Cyrillic Small Letter Palochka (U+04CF) before displaying them as Unicode. With a specially crafted IDN domain, a context-dependent attacker can spoof an omnibox address.
 - An out-of-bounds read flaw exists in 'modules/video_coding/rtp_frame_reference_finder.cc' that is triggered when handling VP9 RTP frames. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose sensitive memory contents.
 - An out-of-bounds read flaw exists in the 'RtpFrameReferenceFinder::MissingRequiredFrameVp9()' function in 'modules/video_coding/rtp_frame_reference_finder.cc' that is triggered when handling VP9 temporal layers. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose sensitive memory contents.
 - A flaw exists that allows a universal cross-site scripting (UXSS) attack. This flaw exists exists because the program does not validate input before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
 - A use-after-free error exists in 'content/browser/indexed_db/indexed_db_transaction.cc' that is triggered when handling IndexedDB transactions. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'ReadableStreamBytesConsumer::OnFulfilled()' function in 'blink/renderer/core/fetch/readable_stream_bytes_consumer.cc'. This may allow a context-dependent attacker to potentially execute arbitrary code.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2018-6118     Ned Williamson discovered a use-after-free issue.

  - CVE-2018-6120     Zhou Aiting discovered a buffer overflow issue in the     pdfium library.

  - CVE-2018-6121     It was discovered that malicious extensions could     escalate privileges.

  - CVE-2018-6122     A type confusion issue was discovered in the v8     JavaScript library.

  - CVE-2018-6123     Looben Yang discovered a use-after-free issue.

  - CVE-2018-6124     Guang Gong discovered a type confusion issue.

  - CVE-2018-6125     Yubico discovered that the WebUSB implementation was too     permissive.

  - CVE-2018-6126     Ivan Fratric discovered a buffer overflow issue in the     skia library.

  - CVE-2018-6127     Looben Yang discovered a use-after-free issue.

  - CVE-2018-6129     Natalie Silvanovich discovered an out-of-bounds read     issue in WebRTC.

  - CVE-2018-6130     Natalie Silvanovich discovered an out-of-bounds read     issue in WebRTC.

  - CVE-2018-6131     Natalie Silvanovich discovered an error in WebAssembly.

  - CVE-2018-6132     Ronald E. Crane discovered an uninitialized memory     issue.

  - CVE-2018-6133     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6134     Jun Kokatsu discovered a way to bypass the Referrer     Policy.

  - CVE-2018-6135     Jasper Rebane discovered a user interface spoofing     issue.

  - CVE-2018-6136     Peter Wong discovered an out-of-bounds read issue in the     v8 JavaScript library.

  - CVE-2018-6137     Michael Smith discovered an information leak.

  - CVE-2018-6138     Francois Lajeunesse-Robert discovered that the     extensions policy was too permissive.

  - CVE-2018-6139     Rob Wu discovered a way to bypass restrictions in the     debugger extension.

  - CVE-2018-6140     Rob Wu discovered a way to bypass restrictions in the     debugger extension.

  - CVE-2018-6141     Yangkang discovered a buffer overflow issue in the skia     library.

  - CVE-2018-6142     Choongwoo Han discovered an out-of-bounds read in the v8     JavaScript library.

  - CVE-2018-6143     Guang Gong discovered an out-of-bounds read in the v8     JavaScript library.

  - CVE-2018-6144     pdknsk discovered an out-of-bounds read in the pdfium     library.

  - CVE-2018-6145     Masato Kinugawa discovered an error in the MathML     implementation.

  - CVE-2018-6147     Michail Pishchagin discovered an error in password entry     fields.

  - CVE-2018-6148     Michal Bentkowski discovered that the Content Security     Policy header was handled incorrectly.

  - CVE-2018-6149     Yu Zhou and Jundong Xie discovered an out-of-bounds     write issue in the v8 JavaScript library.

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 67.0.3396.62.

Security Fix(es) :

* chromium-browser: Use after free in Blink (CVE-2018-6123)

* chromium-browser: Type confusion in Blink (CVE-2018-6124)

* chromium-browser: Overly permissive policy in WebUSB (CVE-2018-6125)

* chromium-browser: Heap buffer overflow in Skia (CVE-2018-6126)

* chromium-browser: Use after free in indexedDB (CVE-2018-6127)

* chromium-browser: Out of bounds memory access in WebRTC (CVE-2018-6129)

* chromium-browser: Out of bounds memory access in WebRTC (CVE-2018-6130)

* chromium-browser: Incorrect mutability protection in WebAssembly (CVE-2018-6131)

* chromium-browser: Use of uninitialized memory in WebRTC (CVE-2018-6132)

* chromium-browser: URL spoof in Omnibox (CVE-2018-6133)

* chromium-browser: Referrer Policy bypass in Blink (CVE-2018-6134)

* chromium-browser: UI spoofing in Blink (CVE-2018-6135)

* chromium-browser: Out of bounds memory access in V8 (CVE-2018-6136)

* chromium-browser: Leak of visited status of page in Blink (CVE-2018-6137)

* chromium-browser: Overly permissive policy in Extensions (CVE-2018-6138)

* chromium-browser: Restrictions bypass in the debugger extension API (CVE-2018-6139)

* chromium-browser: Restrictions bypass in the debugger extension API (CVE-2018-6140)

* chromium-browser: Heap buffer overflow in Skia (CVE-2018-6141)

* chromium-browser: Out of bounds memory access in V8 (CVE-2018-6142)

* chromium-browser: Out of bounds memory access in V8 (CVE-2018-6143)

* chromium-browser: Out of bounds memory access in PDFium (CVE-2018-6144)

* chromium-browser: Incorrect escaping of MathML in Blink (CVE-2018-6145)

* chromium-browser: Password fields not taking advantage of OS protections in Views (CVE-2018-6147)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

This update for chromium to version 66.0.3359.181 fixes the following issues :

The following security issues were fixed (boo#1095163) :

  - CVE-2018-6123: Use after free in Blink.

  - CVE-2018-6124: Type confusion in Blink.

  - CVE-2018-6125: Overly permissive policy in WebUSB.

  - CVE-2018-6126: Heap buffer overflow in Skia.

  - CVE-2018-6127: Use after free in indexedDB.

  - CVE-2018-6128: uXSS in Chrome on iOS.

  - CVE-2018-6129: Out of bounds memory access in WebRTC.

  - CVE-2018-6130: Out of bounds memory access in WebRTC.

  - CVE-2018-6131: Incorrect mutability protection in     WebAssembly.

  - CVE-2018-6132: Use of uninitialized memory in WebRTC.

  - CVE-2018-6133: URL spoof in Omnibox.

  - CVE-2018-6134: Referrer Policy bypass in Blink.

  - CVE-2018-6135: UI spoofing in Blink.

  - CVE-2018-6136: Out of bounds memory access in V8.

  - CVE-2018-6137: Leak of visited status of page in Blink.

  - CVE-2018-6138: Overly permissive policy in Extensions.

  - CVE-2018-6139: Restrictions bypass in the debugger     extension API.

  - CVE-2018-6140: Restrictions bypass in the debugger     extension API.

  - CVE-2018-6141: Heap buffer overflow in Skia.

  - CVE-2018-6142: Out of bounds memory access in V8.

  - CVE-2018-6143: Out of bounds memory access in V8.

  - CVE-2018-6144: Out of bounds memory access in PDFium.

  - CVE-2018-6145: Incorrect escaping of MathML in Blink.

  - CVE-2018-6147: Password fields not taking advantage of     OS protections in Views.

Additional changes :

  - Autoplay: Force enable on desktop for Web Audio This     update enables the 'Strict site isolation' feature for a     larger percentage of users. This feature is a mitigation     against the Spectre vulnerabilities. It can be turned on     via: chrome://flags/#enable-site-per-process It can be     disabled via:
    chrome://flags/#site-isolation-trial-opt-out

Google Chrome Releases reports :

34 security fixes in this release, including :

- [835639] High CVE-2018-6123: Use after free in Blink. Reported by Looben Yang on 2018-04-22

- [840320] High CVE-2018-6124: Type confusion in Blink. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-07

- [818592] High CVE-2018-6125: Overly permissive policy in WebUSB.
Reported by Yubico, Inc on 2018-03-05

- [844457] High CVE-2018-6126: Heap buffer overflow in Skia. Reported by Ivan Fratric of Google Project Zero on 2018-05-18

- [842990] High CVE-2018-6127: Use after free in indexedDB. Reported by Looben Yang on 2018-05-15

- [841105] High CVE-2018-6128: uXSS in Chrome on iOS. Reported by Tomasz Bojarski on 2018-05-09

- [838672] High CVE-2018-6129: Out of bounds memory access in WebRTC.
Reported by Natalie Silvanovich of Google Project Zero on 2018-05-01

- [838402] High CVE-2018-6130: Out of bounds memory access in WebRTC.
Reported by Natalie Silvanovich of Google Project Zero on 2018-04-30

- [826434] High CVE-2018-6131: Incorrect mutability protection in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-27

- [839960] Medium CVE-2018-6132: Use of uninitialized memory in WebRTC. Reported by Ronald E. Crane on 2018-05-04

- [817247] Medium CVE-2018-6133: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-28

- [797465] Medium CVE-2018-6134: Referrer Policy bypass in Blink.
Reported by Jun Kokatsu (@shhnjk) on 2017-12-23

- [823353] Medium CVE-2018-6135: UI spoofing in Blink. Reported by Jasper Rebane on 2018-03-19

- [831943] Medium CVE-2018-6136: Out of bounds memory access in V8.
Reported by Peter Wong on 2018-04-12

- [835589] Medium CVE-2018-6137: Leak of visited status of page in Blink. Reported by Michael Smith (spinda.net) on 2018-04-21

- [810220] Medium CVE-2018-6138: Overly permissive policy in Extensions. Reported by Francois Lajeunesse-Robert on 2018-02-08

- [805224] Medium CVE-2018-6139: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-24

- [798222] Medium CVE-2018-6140: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-01

- [796107] Medium CVE-2018-6141: Heap buffer overflow in Skia.
Reported by Yangkang (@dnpushme) and Wanglu of Qihoo360 Qex Team on 2017-12-19

- [837939] Medium CVE-2018-6142: Out of bounds memory access in V8.
Reported by Choongwoo Han of Naver Corporation on 2018-04-28

- [843022] Medium CVE-2018-6143: Out of bounds memory access in V8.
Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-15

- [828049] Low CVE-2018-6144: Out of bounds memory access in PDFium.
Reported by pdknsk on 2018-04-02

- [805924] Low CVE-2018-6145: Incorrect escaping of MathML in Blink.
Reported by Masato Kinugawa on 2018-01-25

- [818133] Low CVE-2018-6147: Password fields not taking advantage of OS protections in Views. Reported by Michail Pishchagin (Yandex) on 2018-03-02

- [847542] Various fixes from internal audits, fuzzing and other initiatives

The version of Google Chrome installed on the remote host is prior to 67.0.3396.62. It is, therefore, affected by multiple unspecified vulnerabilities as noted in Chrome stable channel update release notes for May 29th, 2018. Please refer to the release notes for additional information.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 67.0.3396.62. It is, therefore, affected by a multiple unspecified vulnerabilities as noted in Chrome stable channel update release notes for May 29th, 2018. Please refer to the release notes for additional information.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
123234	openSUSE Security Update : Chromium (openSUSE-2019-548)	Nessus	SuSE Local Security Checks	high
120558	Fedora 28 : chromium (2018-7c80aaef26)	Nessus	Fedora Local Security Checks	high
700358	Google Chrome < 67.0.3396.62 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
111345	openSUSE Security Update : Chromium (openSUSE-2018-759)	Nessus	SuSE Local Security Checks	high
110820	Debian DSA-4237-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
110625	Fedora 27 : chromium (2018-09b59b0227)	Nessus	Fedora Local Security Checks	high
110406	RHEL 6 : chromium-browser (RHSA-2018:1815)	Nessus	Red Hat Local Security Checks	high
110275	openSUSE Security Update : chromium (openSUSE-2018-546)	Nessus	SuSE Local Security Checks	high
110254	FreeBSD : chromium -- multiple vulnerabilities (427b0f58-644c-11e8-9e1b-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	high
110229	Google Chrome < 67.0.3396.62 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	high
110228	Google Chrome < 67.0.3396.62 Multiple Vulnerabilities	Nessus	Windows	high

CVE-2018-6135

MEDIUM

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Configuration 2

Configuration 3

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high