Use after free in speech in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0738 advisory.

  - An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer     overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in     common/unistr.cpp. (CVE-2020-10531)

  - Type confusion in V8 in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6383)

  - Use after free in WebAudio in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6384)

  - Use after free in speech in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6386)

  - Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.122 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6407)

  - Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6418)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Microsoft Edge (Chromium) installed on the remote Windows host is prior to 80.0.361.57. It is, therefore, affected by multiple vulnerabilities:

  - A use-after-free vulnerability exists in the V8 component of Google Chrome. An unauthenticated, remote     attacker can exploit this, via a crafted HTML page, to potentially exploit heap corruption.
    (CVE-2020-6383)

  - A use-after-free vulnerability exists in the WebAudio component of Google Chrome. An unauthenticated,     remote attacker can exploit this, via a crafted HTML page, to potentially exploit heap corruption.
    (CVE-2020-6384)

  - A use-after-free vulnerability exists in the speech component of Google Chrome. An unauthenticated, remote     attacker can exploit this, via a crafted HTML page, to potentially exploit heap corruption.
    (CVE-2020-6386)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 80.0.3987.149. Upstream says it fixes '13' security issues, but only lists these CVEs :

  - CVE-2020-6422: Use after free in WebGL

  - CVE-2020-6424: Use after free in media

  - CVE-2020-6425: Insufficient policy enforcement in     extensions. 

  - CVE-2020-6426: Inappropriate implementation in V8

  - CVE-2020-6427: Use after free in audio

  - CVE-2020-6428: Use after free in audio

  - CVE-2020-6429: Use after free in audio.

  - CVE-2019-20503: Out of bounds read in usersctplib.

  - CVE-2020-6449: Use after free in audio

----

Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled by default except on NVIDIA.

List of CVEs fixed (since last update) :

  - CVE-2019-20446

  - CVE-2020-6381 

  - CVE-2020-6382 

  - CVE-2020-6383 

  - CVE-2020-6384

  - CVE-2020-6385 

  - CVE-2020-6386

  - CVE-2020-6387 

  - CVE-2020-6388

  - CVE-2020-6389

  - CVE-2020-6390 

  - CVE-2020-6391

  - CVE-2020-6392 

  - CVE-2020-6393

  - CVE-2020-6394

  - CVE-2020-6395

  - CVE-2020-6396 

  - CVE-2020-6397 

  - CVE-2020-6398

  - CVE-2020-6399 

  - CVE-2020-6400 

  - CVE-2020-6401 

  - CVE-2020-6402 

  - CVE-2020-6403 

  - CVE-2020-6404 

  - CVE-2020-6405 

  - CVE-2020-6406 

  - CVE-2020-6407

  - CVE-2020-6408 

  - CVE-2020-6409 

  - CVE-2020-6410 

  - CVE-2020-6411 

  - CVE-2020-6412 

  - CVE-2020-6413 

  - CVE-2020-6414 

  - CVE-2020-6415 

  - CVE-2020-6416 

  - CVE-2020-6417

  - CVE-2020-6418

  - CVE-2020-6420 

----

Update to 79.0.3945.130. Fixes the following security issues :

  - CVE-2020-6378

  - CVE-2020-6379

  - CVE-2020-6380

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled by default except on NVIDIA.

List of CVEs fixed (since last update) :

  - CVE-2019-20446

  - CVE-2020-6381 

  - CVE-2020-6382 

  - CVE-2020-6383 

  - CVE-2020-6384

  - CVE-2020-6385 

  - CVE-2020-6386

  - CVE-2020-6387 

  - CVE-2020-6388

  - CVE-2020-6389

  - CVE-2020-6390 

  - CVE-2020-6391

  - CVE-2020-6392 

  - CVE-2020-6393

  - CVE-2020-6394

  - CVE-2020-6395

  - CVE-2020-6396 

  - CVE-2020-6397 

  - CVE-2020-6398

  - CVE-2020-6399 

  - CVE-2020-6400 

  - CVE-2020-6401 

  - CVE-2020-6402 

  - CVE-2020-6403 

  - CVE-2020-6404 

  - CVE-2020-6405 

  - CVE-2020-6406 

  - CVE-2020-6407

  - CVE-2020-6408 

  - CVE-2020-6409 

  - CVE-2020-6410 

  - CVE-2020-6411 

  - CVE-2020-6412 

  - CVE-2020-6413 

  - CVE-2020-6414 

  - CVE-2020-6415 

  - CVE-2020-6416 

  - CVE-2020-6417

  - CVE-2020-6418

  - CVE-2020-6420

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2019-19880     Richard Lorenz discovered an issue in the sqlite     library.

  - CVE-2019-19923     Richard Lorenz discovered an out-of-bounds read issue in     the sqlite library.

  - CVE-2019-19925     Richard Lorenz discovered an issue in the sqlite     library.

  - CVE-2019-19926     Richard Lorenz discovered an implementation error in the     sqlite library.

  - CVE-2020-6381     UK's National Cyber Security Centre discovered an     integer overflow issue in the v8 JavaScript library.

  - CVE-2020-6382     Soyeon Park and Wen Xu discovered a type error in the v8     JavaScript library.

  - CVE-2020-6383     Sergei Glazunov discovered a type error in the v8     JavaScript library.

  - CVE-2020-6384     David Manoucheri discovered a use-after-free issue in     WebAudio.

  - CVE-2020-6385     Sergei Glazunov discovered a policy enforcement error.

  - CVE-2020-6386     Zhe Jin discovered a use-after-free issue in speech     processing.

  - CVE-2020-6387     Natalie Silvanovich discovered an out-of-bounds write     error in the WebRTC implementation.

  - CVE-2020-6388     Sergei Glazunov discovered an out-of-bounds read error     in the WebRTC implementation.

  - CVE-2020-6389     Natalie Silvanovich discovered an out-of-bounds write     error in the WebRTC implementation.

  - CVE-2020-6390     Sergei Glazunov discovered an out-of-bounds read error.

  - CVE-2020-6391     Michal Bentkowski discoverd that untrusted input was     insufficiently validated.

  - CVE-2020-6392     The Microsoft Edge Team discovered a policy enforcement     error.

  - CVE-2020-6393     Mark Amery discovered a policy enforcement error.

  - CVE-2020-6394     Phil Freo discovered a policy enforcement error.

  - CVE-2020-6395     Pierre Langlois discovered an out-of-bounds read error     in the v8 JavaScript library.

  - CVE-2020-6396     William Luc Ritchie discovered an error in the skia     library.

  - CVE-2020-6397     Khalil Zhani discovered a user interface error.

  - CVE-2020-6398     pdknsk discovered an uninitialized variable in the     pdfium library.

  - CVE-2020-6399     Luan Herrera discovered a policy enforcement error.

  - CVE-2020-6400     Takashi Yoneuchi discovered an error in Cross-Origin     Resource Sharing.

  - CVE-2020-6401     Tzachy Horesh discovered that user input was     insufficiently validated.

  - CVE-2020-6402     Vladimir Metnew discovered a policy enforcement error.

  - CVE-2020-6403     Khalil Zhani discovered a user interface error.

  - CVE-2020-6404     kanchi discovered an error in Blink/Webkit.

  - CVE-2020-6405     Yongheng Chen and Rui Zhong discovered an out-of-bounds     read issue in the sqlite library.

  - CVE-2020-6406     Sergei Glazunov discovered a use-after-free issue.

  - CVE-2020-6407     Sergei Glazunov discovered an out-of-bounds read error.

  - CVE-2020-6408     Zhong Zhaochen discovered a policy enforcement error in     Cross-Origin Resource Sharing.

  - CVE-2020-6409     Divagar S and Bharathi V discovered an error in the     omnibox implementation.

  - CVE-2020-6410     evil1m0 discovered a policy enforcement error.

  - CVE-2020-6411     Khalil Zhani discovered that user input was     insufficiently validated.

  - CVE-2020-6412     Zihan Zheng discovered that user input was     insufficiently validated.

  - CVE-2020-6413     Michal Bentkowski discovered an error in Blink/Webkit.

  - CVE-2020-6414     Lijo A.T discovered a policy safe browsing policy     enforcement error.

  - CVE-2020-6415     Avihay Cohen discovered an implementation error in the     v8 JavaScript library.

  - CVE-2020-6416     Woojin Oh discovered that untrusted input was     insufficiently validated.

  - CVE-2020-6418     Clement Lecigne discovered a type error in the v8     JavaScript library.

  - CVE-2020-6420     Taras Uzdenov discovered a policy enforcement error.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0738 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 80.0.3987.122.

    Security Fix(es):

    * ICU: Integer overflow in UnicodeString::doAppend() (BZ#1807349)

    * chromium-browser: Type confusion in V8 (CVE-2020-6383)

    * chromium-browser: Use after free in WebAudio (CVE-2020-6384)

    * chromium-browser: Use after free in speech (CVE-2020-6386)

    * chromium-browser: Out of bounds memory access in streams (CVE-2020-6407)

    * chromium-browser: Type confusion in V8 (CVE-2020-6418)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 80.0.3987.116. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_02_stable-channel-update-for-desktop_18 advisory.

  - Use after free in speech in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6386)

  - Type confusion in V8 in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6383)

  - Use after free in WebAudio in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6384)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 80.0.3987.116. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_02_stable-channel-update-for-desktop_18 advisory.

  - Use after free in speech in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6386)

  - Type confusion in V8 in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6383)

  - Use after free in WebAudio in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6384)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
208464	CentOS 6 : chromium-browser (RHSA-2020:0738)	Nessus	CentOS Local Security Checks	Local	high
138177	Microsoft Edge (Chromium) < 80.0.361.57 Multiple Vulnerabilities	Nessus	Windows	Local	high
134990	Fedora 30 : chromium (2020-39e0b8bd14)	Nessus	Fedora Local Security Checks	Local	high
134718	Fedora 31 : chromium (2020-f6271d7afa)	Nessus	Fedora Local Security Checks	Local	high
134433	Debian DSA-4638-1 : chromium - security update	Nessus	Debian Local Security Checks	Local	high
134360	RHEL 6 : chromium-browser (RHSA-2020:0738)	Nessus	Red Hat Local Security Checks	Local	high
133848	Google Chrome < 80.0.3987.116 Multiple Vulnerabilities	Nessus	Windows	Local	high
133847	Google Chrome < 80.0.3987.116 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	high

Detections

Analytics

CVE-2020-6386

high

Tenable Plugins

high

high

high

high

high

high

high

high