Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1270 advisory.

  - usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init. (CVE-2019-20503)

  - Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6422)

  - Use after free in media in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6424)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker     who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome     Extension. (CVE-2020-6425)

  - Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6426)

  - Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6427, CVE-2020-6428, CVE-2020-6429,     CVE-2020-6449)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially
    exploit heap corruption via a crafted HTML page. (CVE-2020-6429)

  - usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init. (CVE-2019-20503)

  - Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially
    exploit heap corruption via a crafted HTML page. (CVE-2020-6422)

  - Use after free in media in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially
    exploit heap corruption via a crafted HTML page. (CVE-2020-6424)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker
    who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome
    Extension. (CVE-2020-6425)

The version of Microsoft Edge (Chromium) installed on the remote Windows host is prior to 80.0.361.69. It is, therefore, affected by multiple vulnerabilities:

  - A use-after-free error exists in the WebGL component of Microsoft Edge (Chromium). An unauthenticated,     remote attacker can exploit this, via a crafted HTML page, to potentially exploit heap corruption.
    (CVE-2020-6422)

  - A use-after-free error exists in the media component of Microsoft Edge (Chromium). An unauthenticated,     remote attacker can exploit this, via a crafted HTML page, to potentially exploit heap corruption.
    (CVE-2020-6424)

  - A use-after-free error exists in the audio component of Microsoft Edge (Chromium). An unauthenticated,     remote attacker can exploit this, via a crafted HTML page, to potentially exploit heap corruption.
    (CVE-2020-6427)

In addition, Microsoft Edge (Chromium) is also affected by several additional vulnerabilities and errors including additional use-after-free vulnerabilities, an out-of-bounds read, and an insufficient policy enforcement. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1270 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 80.0.3987.149.

    Security Fix(es):

    * chromium-browser: Use after free in WebGL (CVE-2020-6422)

    * chromium-browser: Use after free in media (CVE-2020-6424)

    * chromium-browser: Insufficient policy enforcement in extensions (CVE-2020-6425)

    * chromium-browser: Inappropriate implementation in V8 (CVE-2020-6426)

    * chromium-browser: Use after free in audio (CVE-2020-6427)

    * chromium-browser: Use after free in audio (CVE-2020-6428)

    * chromium-browser: Use after free in audio (CVE-2020-6429)

    * chromium-browser: Use after free in audio (CVE-2020-6449)

    * usrsctp: Out of bounds reads in sctp_load_addresses_from_init() (CVE-2019-20503)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 80.0.3987.149. Upstream says it fixes '13' security issues, but only lists these CVEs :

  - CVE-2020-6422: Use after free in WebGL

  - CVE-2020-6424: Use after free in media

  - CVE-2020-6425: Insufficient policy enforcement in     extensions. 

  - CVE-2020-6426: Inappropriate implementation in V8

  - CVE-2020-6427: Use after free in audio

  - CVE-2020-6428: Use after free in audio

  - CVE-2020-6429: Use after free in audio.

  - CVE-2019-20503: Out of bounds read in usersctplib.

  - CVE-2020-6449: Use after free in audio

----

Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled by default except on NVIDIA.

List of CVEs fixed (since last update) :

  - CVE-2019-20446

  - CVE-2020-6381 

  - CVE-2020-6382 

  - CVE-2020-6383 

  - CVE-2020-6384

  - CVE-2020-6385 

  - CVE-2020-6386

  - CVE-2020-6387 

  - CVE-2020-6388

  - CVE-2020-6389

  - CVE-2020-6390 

  - CVE-2020-6391

  - CVE-2020-6392 

  - CVE-2020-6393

  - CVE-2020-6394

  - CVE-2020-6395

  - CVE-2020-6396 

  - CVE-2020-6397 

  - CVE-2020-6398

  - CVE-2020-6399 

  - CVE-2020-6400 

  - CVE-2020-6401 

  - CVE-2020-6402 

  - CVE-2020-6403 

  - CVE-2020-6404 

  - CVE-2020-6405 

  - CVE-2020-6406 

  - CVE-2020-6407

  - CVE-2020-6408 

  - CVE-2020-6409 

  - CVE-2020-6410 

  - CVE-2020-6411 

  - CVE-2020-6412 

  - CVE-2020-6413 

  - CVE-2020-6414 

  - CVE-2020-6415 

  - CVE-2020-6416 

  - CVE-2020-6417

  - CVE-2020-6418

  - CVE-2020-6420 

----

Update to 79.0.3945.130. Fixes the following security issues :

  - CVE-2020-6378

  - CVE-2020-6379

  - CVE-2020-6380

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202003-53 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted HTML       or multimedia file using Chromium or Google Chrome, possibly resulting in       execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Update to 80.0.3987.149. Upstream says it fixes '13' security issues, but only lists these CVEs :

  - CVE-2020-6422: Use after free in WebGL

  - CVE-2020-6424: Use after free in media

  - CVE-2020-6425: Insufficient policy enforcement in     extensions. 

  - CVE-2020-6426: Inappropriate implementation in V8

  - CVE-2020-6427: Use after free in audio

  - CVE-2020-6428: Use after free in audio

  - CVE-2020-6429: Use after free in audio.

  - CVE-2019-20503: Out of bounds read in usersctplib.

  - CVE-2020-6449: Use after free in audio

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2019-20503     Natalie Silvanovich discovered an out-of-bounds read     issue in the usrsctp library.

  - CVE-2020-6422     David Manouchehri discovered a use-after-free issue in     the WebGL implementation.

  - CVE-2020-6424     Sergei Glazunov discovered a use-after-free issue.

  - CVE-2020-6425     Sergei Glazunov discovered a policy enforcement error     related to extensions.

  - CVE-2020-6426     Avihay Cohen discovered an implementation error in the     v8 JavaScript library.

  - CVE-2020-6427     Man Yue Mo discovered a use-after-free issue in the     audio implementation.

  - CVE-2020-6428     Man Yue Mo discovered a use-after-free issue in the     audio implementation.

  - CVE-2020-6429     Man Yue Mo discovered a use-after-free issue in the     audio implementation.

  - CVE-2020-6449     Man Yue Mo discovered a use-after-free issue in the     audio implementation.

This update for chromium to version 80.0.3987.149 fixes the following issues :

Chromium was update to 80.0.3987.149 (bsc#1167090) :

  - CVE-2020-6422: Fixed a use after free in WebGL. 

  - CVE-2020-6424: Fixed a use after free in media. 

  - CVE-2020-6425: Fixed an insufficient policy enforcement     in extensions. 

  - CVE-2020-6426: Fixed an inappropriate implementation in     V8. 

  - CVE-2020-6427: Fixed a use after free in audio. 

  - CVE-2020-6428: Fixed a use after free in audio. 

  - CVE-2020-6429: Fixed a use after free in audio. 

  - CVE-2019-20503: Fixed an out of bounds read in     usersctplib.

  - CVE-2020-6449: Fixed a use after free in audio.

The version of Google Chrome installed on the remote Windows host is prior to 80.0.3987.149. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_03_stable-channel-update-for-desktop_18 advisory.

  - Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6427, CVE-2020-6428, CVE-2020-6429,     CVE-2020-6449)

  - Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6422)

  - Use after free in media in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6424)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker     who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome     Extension. (CVE-2020-6425)

  - Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6426)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 80.0.3987.149. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_03_stable-channel-update-for-desktop_18 advisory.

  - Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6427, CVE-2020-6428, CVE-2020-6429,     CVE-2020-6449)

  - Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6422)

  - Use after free in media in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6424)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker     who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome     Extension. (CVE-2020-6425)

  - Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6426)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
208458	CentOS 6 : chromium-browser (RHSA-2020:1270)	Nessus	CentOS Local Security Checks	Local	high
403814	Alpine: multiple chromium packages: security update to 80.0.3987.149-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
403814	Alpine: multiple chromium packages: security update to 80.0.3987.149-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
138215	Microsoft Edge (Chromium) < 80.0.361.69 Multiple Vulnerabilities	Nessus	Windows	Local	high
135086	RHEL 6 : chromium-browser (RHSA-2020:1270)	Nessus	Red Hat Local Security Checks	Local	high
134990	Fedora 30 : chromium (2020-39e0b8bd14)	Nessus	Fedora Local Security Checks	Local	high
134928	GLSA-202003-53 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
134842	Fedora 31 : chromium (2020-7fd051b378)	Nessus	Fedora Local Security Checks	Local	high
134839	Debian DSA-4645-1 : chromium - security update	Nessus	Debian Local Security Checks	Local	high
134822	openSUSE Security Update : chromium (openSUSE-2020-365)	Nessus	SuSE Local Security Checks	Local	high
134701	Google Chrome < 80.0.3987.149 Multiple Vulnerabilities	Nessus	Windows	Local	high
134700	Google Chrome < 80.0.3987.149 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	high

Detections

Analytics

CVE-2020-6428

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high