Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1350 advisory.

  - Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6450, CVE-2020-6451)

  - Heap buffer overflow in media in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6452)

  - Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6453)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Microsoft Edge (Chromium) installed on the remote Windows host is prior to 80.0.361.109. It is, therefore, affected by multiple vulnerabilities:

  - A use-after-free error exists in the WebAudio component of Google Chrome. An unauthenticated, remote attacker     can exploit this, via a crafted HTML page, to potentially exploit heap corruption. (CVE-2020-6450, CVE-2020-6451)

  - A heap-based buffer overflow condition exists Google Chrome. An unauthenticated, remote attacker     can exploit this, via a crafted HTML page, to potentially exploit heap corruption. (CVE-2020-6452)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Bugfix release from Google for 80.0.3987.162.

----

Update to 80.0.3987.162. Fixes the following CVEs :

  - CVE-2020-6450

  - CVE-2020-6451

  - CVE-2020-6452

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for chromium fixes the following issues :

Chromium was updated to 81.0.4044.92 boo#1168911 :

  - CVE-2020-6454: Use after free in extensions

  - CVE-2020-6423: Use after free in audio

  - CVE-2020-6455: Out of bounds read in WebSQL

  - CVE-2020-6430: Type Confusion in V8

  - CVE-2020-6456: Insufficient validation of untrusted     input in clipboard

  - CVE-2020-6431: Insufficient policy enforcement in full     screen

  - CVE-2020-6432: Insufficient policy enforcement in     navigations

  - CVE-2020-6433: Insufficient policy enforcement in     extensions

  - CVE-2020-6434: Use after free in devtools

  - CVE-2020-6435: Insufficient policy enforcement in     extensions

  - CVE-2020-6436: Use after free in window management

  - CVE-2020-6437: Inappropriate implementation in WebView

  - CVE-2020-6438: Insufficient policy enforcement in     extensions

  - CVE-2020-6439: Insufficient policy enforcement in     navigations

  - CVE-2020-6440: Inappropriate implementation in     extensions

  - CVE-2020-6441: Insufficient policy enforcement in     omnibox

  - CVE-2020-6442: Inappropriate implementation in cache

  - CVE-2020-6443: Insufficient data validation in developer     tools

  - CVE-2020-6444: Uninitialized Use in WebRTC

  - CVE-2020-6445: Insufficient policy enforcement in     trusted types

  - CVE-2020-6446: Insufficient policy enforcement in     trusted types

  - CVE-2020-6447: Inappropriate implementation in developer     tools

  - CVE-2020-6448: Use after free in V8

Chromium was updated to 80.0.3987.162 boo#1168421 :

  - CVE-2020-6450: Use after free in WebAudio.

  - CVE-2020-6451: Use after free in WebAudio.

  - CVE-2020-6452: Heap buffer overflow in media.

  - Use a symbolic icon for GNOME

The remote host is affected by the vulnerability described in GLSA-202004-09 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted HTML       or multimedia file using Chromium or Google Chrome, possibly resulting in       execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2020-6450     Man Yue Mo discovered a use-after-free issue in the     WebAudio implementation.

  - CVE-2020-6451     Man Yue Mo discovered a use-after-free issue in the     WebAudio implementation.

  - CVE-2020-6452     asnine discovered a buffer overflow issue.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1350 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 80.0.3987.162.

    Security Fix(es):

    * chromium-browser: Use after free in WebAudio (CVE-2020-6450)

    * chromium-browser: Use after free in WebAudio (CVE-2020-6451)

    * chromium-browser: Heap buffer overflow in media (CVE-2020-6452)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Google Chrome Releases reports :

This update contains 8 security fixes.

- [1062247] High CVE-2020-6450: Use after free in WebAudio. Reported by Man Yue Mo of Semmle Security Research Team on 2020-03-17

- [1061018] High CVE-2020-6451: Use after free in WebAudio. Reported by Man Yue Mo of Semmle Security Research Team on 2020-03-12

- [1059764] High CVE-2020-6452: Heap buffer overflow in media Reported by asnine on 2020-03-09

- [1066247] Various fixes from internal audits, fuzzing and other initiatives.

The version of Google Chrome installed on the remote Windows host is prior to 80.0.3987.162. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_03_stable-channel-update-for-desktop_31 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 80.0.3987.162. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_03_stable-channel-update-for-desktop_31 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208456	CentOS 6 : chromium-browser (RHSA-2020:1350)	Nessus	CentOS Local Security Checks	high
138214	Microsoft Edge (Chromium) < 80.0.361.109 Multiple Vulnerabilities	Nessus	Windows	high
135726	Fedora 31 : chromium (2020-161c87cbc7)	Nessus	Fedora Local Security Checks	high
135601	Fedora 30 : chromium (2020-b2df49bb01)	Nessus	Fedora Local Security Checks	high
135577	openSUSE Security Update : chromium (openSUSE-2020-519)	Nessus	SuSE Local Security Checks	high
135427	GLSA-202004-09 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
135365	Debian DSA-4654-1 : chromium - security update	Nessus	Debian Local Security Checks	high
135243	RHEL 6 : chromium-browser (RHSA-2020:1350)	Nessus	Red Hat Local Security Checks	high
135193	FreeBSD : chromium -- multiple vulnerabilities (9cb57a06-7517-11ea-b594-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	high
135094	Google Chrome < 80.0.3987.162 Multiple Vulnerabilities	Nessus	Windows	high
135093	Google Chrome < 80.0.3987.162 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2020-6450

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high