Use after free in task scheduling in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1981 advisory.

  - Use after free in storage in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-6461)

  - Use after free in task scheduling in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-6462)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Microsoft Edge (Chromium) installed on the remote Windows host is prior to 81.0.416.68.   It is, therefore, affected by multiple vulnerabilities:

  - A use after free in storage in Microsoft Edge (Chromium) allowed a remote attacker     who had compromised the renderer process to potentially perform a sandbox escape via a crafted     HTML page. (CVE-2020-6461)

  - A use after free in task scheduling in Microsoft Edge (Chromium) allowed a remote     attacker who had compromised the renderer process to potentially perform a sandbox escape via a     crafted HTML page. (CVE-2020-6462)

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2020-6423     A use-after-free issue was found in the audio     implementation.

  - CVE-2020-6430     Avihay Cohen discovered a type confusion issue in the v8     JavaScript library.

  - CVE-2020-6431     Luan Herrera discovered a policy enforcement error.

  - CVE-2020-6432     Luan Herrera discovered a policy enforcement error.

  - CVE-2020-6433     Luan Herrera discovered a policy enforcement error in     extensions.

  - CVE-2020-6434     HyungSeok Han discovered a use-after-free issue in the     developer tools.

  - CVE-2020-6435     Sergei Glazunov discovered a policy enforcement error in     extensions.

  - CVE-2020-6436     Igor Bukanov discovered a use-after-free issue.

  - CVE-2020-6437     Jann Horn discovered an implementation error in WebView.

  - CVE-2020-6438     Ng Yik Phang discovered a policy enforcement error in     extensions.

  - CVE-2020-6439     remkoboonstra discovered a policy enforcement error.

  - CVE-2020-6440     David Erceg discovered an implementation error in     extensions.

  - CVE-2020-6441     David Erceg discovered a policy enforcement error.

  - CVE-2020-6442     B@rMey discovered an implementation error in the page     cache.

  - CVE-2020-6443     @lovasoa discovered an implementation error in the     developer tools.

  - CVE-2020-6444     mlfbrown discovered an uninitialized variable in the     WebRTC implementation.

  - CVE-2020-6445     Jun Kokatsu discovered a policy enforcement error.

  - CVE-2020-6446     Jun Kokatsu discovered a policy enforcement error.

  - CVE-2020-6447     David Erceg discovered an implementation error in the     developer tools.

  - CVE-2020-6448     Guang Gong discovered a use-after-free issue in the v8     JavaScript library.

  - CVE-2020-6454     Leecraso and Guang Gong discovered a use-after-free     issue in extensions.

  - CVE-2020-6455     Nan Wang and Guang Gong discovered an out-of-bounds read     issue in the WebSQL implementation.

  - CVE-2020-6456     Michal Bentkowski discovered insufficient validation of     untrusted input.

  - CVE-2020-6457     Leecraso and Guang Gong discovered a use-after-free     issue in the speech recognizer.

  - CVE-2020-6458     Aleksandar Nikolic discoved an out-of-bounds read and     write issue in the pdfium library.

  - CVE-2020-6459     Zhe Jin discovered a use-after-free issue in the     payments implementation.

  - CVE-2020-6460     It was discovered that URL formatting was insufficiently     validated.

  - CVE-2020-6461     Zhe Jin discovered a use-after-free issue.

  - CVE-2020-6462     Zhe Jin discovered a use-after-free issue in task     scheduling.

  - CVE-2020-6463     Pawel Wylecial discovered a use-after-free issue in the     ANGLE library.

  - CVE-2020-6464     Looben Yang discovered a type confusion issue in     Blink/Webkit.

  - CVE-2020-6465     Woojin Oh discovered a use-after-free issue.

  - CVE-2020-6466     Zhe Jin discovered a use-after-free issue.

  - CVE-2020-6467     ZhanJia Song discovered a use-after-free issue in the     WebRTC implementation.

  - CVE-2020-6468     Chris Salls and Jake Corina discovered a type confusion     issue in the v8 JavaScript library.

  - CVE-2020-6469     David Erceg discovered a policy enforcement error in the     developer tools.

  - CVE-2020-6470     Michal Bentkowski discovered insufficient validation of     untrusted input.

  - CVE-2020-6471     David Erceg discovered a policy enforcement error in the     developer tools.

  - CVE-2020-6472     David Erceg discovered a policy enforcement error in the     developer tools.

  - CVE-2020-6473     Soroush Karami and Panagiotis Ilia discovered a policy     enforcement error in Blink/Webkit.

  - CVE-2020-6474     Zhe Jin discovered a use-after-free issue in     Blink/Webkit.

  - CVE-2020-6475     Khalil Zhani discovered a user interface error.

  - CVE-2020-6476     Alexandre Le Borgne discovered a policy enforcement     error.

  - CVE-2020-6478     Khalil Zhani discovered an implementation error in full     screen mode.

  - CVE-2020-6479     Zhong Zhaochen discovered an implementation error.

  - CVE-2020-6480     Marvin Witt discovered a policy enforcement error.

  - CVE-2020-6481     Rayyan Bijoora discovered a policy enforcement error.

  - CVE-2020-6482     Abdulrahman Alqabandi discovered a policy enforcement     error in the developer tools.

  - CVE-2020-6483     Jun Kokatsu discovered a policy enforcement error in     payments.

  - CVE-2020-6484     Artem Zinenko discovered insufficient validation of user     data in the ChromeDriver implementation.

  - CVE-2020-6485     Sergei Glazunov discovered a policy enforcement error.

  - CVE-2020-6486     David Erceg discovered a policy enforcement error.

  - CVE-2020-6487     Jun Kokatsu discovered a policy enforcement error.

  - CVE-2020-6488     David Erceg discovered a policy enforcement error.

  - CVE-2020-6489     @lovasoa discovered an implementation error in the     developer tools.

  - CVE-2020-6490     Insufficient validation of untrusted data was     discovered.

  - CVE-2020-6491     Sultan Haikal discovered a user interface error.

  - CVE-2020-6493     A use-after-free issue was discovered in the     WebAuthentication implementation.

  - CVE-2020-6494     Juho Nurimen discovered a user interface error.

  - CVE-2020-6495     David Erceg discovered a policy enforcement error in the     developer tools.

  - CVE-2020-6496     Khalil Zhani discovered a use-after-free issue in     payments.

  - CVE-2020-6497     Rayyan Bijoora discovered a policy enforcement issue.

  - CVE-2020-6498     Rayyan Bijoora discovered a user interface error.

  - CVE-2020-6505     Khalil Zhani discovered a use-after-free issue.

  - CVE-2020-6506     Alesandro Ortiz discovered a policy enforcement error.

  - CVE-2020-6507     Sergei Glazunov discovered an out-of-bounds write issue     in the v8 JavaScript library.

  - CVE-2020-6509     A use-after-free issue was discovered in extensions.

  - CVE-2020-6831     Natalie Silvanovich discovered a buffer overflow issue     in the SCTP library.

The description provided by Fedora was far too silly to endure. Please consult the NIST CVEs for details on these Google Chromium vulnerabilities.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202005-13 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for opera fixes the following issues :

Opera was updated to version 68.0.3618.63

  - CHR-7889 Update chromium on desktop-stable-81-3618 to     81.0.4044.122

  - CHR-7896 Update chromium on desktop-stable-81-3618 to     81.0.4044.129

  - DNA-85287 Set standard spacing for Yandex prompt

  - DNA-85416 [Mac] Animation of tab insert is glitchy on     slow machines

  - DNA-85568 Verify API for triggering &ldquo;unread&rdquo;
    mode with Instagram.

  - DNA-86027 Present Now not working in google meet after     canceling it once

  - DNA-86028 Add a back and forward button in the Instagram     panel

  - DNA-86029 Investigate and implement re-freshing of the     instagram panel content

  - Update chromium to 81.0.4044.122 fixes CVE-2020-6458,     CVE-2020-6459, CVE-2020-6460

  - Update chromium to 81.0.4044.129 fixes CVE-2020-6461,     CVE-2020-6462

Update to version 68.0.3618.56

  - DNA-85256 [Win] Cookies section on site pages is white     in dark mode

  - DNA-85474 [Mac] Dragging tabs to the left with hidden     sidebar is broken

  - DNA-85771 DNS-over-HTTPS example in settings is wrong

  - DNA-85976 Change page display time when navigating from     opera:startpage

  - CHR-7878 Update chromium on desktop-stable-81-3618 to     81.0.4044.113 (CVE-2020-6457)

  - DNA-78158 PATCH-1272 should be removed

  - DNA-84721 Weather widget is overlapped when &lsquo;Use     bigger tiles&rsquo;

  - DNA-85246 Implement 0-state dialog and onboarding

  - DNA-85354 O-menu is misplaced when opened with maximized     opera

  - DNA-85405 Add link to Privacy Policy on the 0-state     dialog

  - DNA-85409 Ask for geolocation EULA once

  - DNA-85426 Crash at opera::DownloadActionButton::Update()

  - DNA-85454 Add id&rsquo;s to elements for testing

  - DNA-85493 Add &ldquo;Show Weather&rdquo; toggle to     &ldquo;Start Page&rdquo; section in Easy Setup

  - DNA-85501 Set timestamps in geolocation exception record

  - DNA-85514 Add fallback when geolocation fails

  - DNA-85713 Report consent for geolocation on start page

  - DNA-85753 Fetch news configuration from new endpoint

  - DNA-85798 Incorrect padding in Search in Tabs window

  - DNA-85801 Disable notification on instagram panel

  - DNA-85809 Update instagram icon in the Sidebar Setup

  - DNA-85854 Change Instagram panel size, to fit desktop     version

  - Complete Opera 68.0 changelog at:
    https://blogs.opera.com/desktop/changelog-for-68/

Update to version 67.0.3575.137

  - CHR-7852 Update chromium on desktop-stable-80-3575 to     80.0.3987.163

  - DNA-82540 Crash at     remote_cocoa::NativeWidgetNSWindowBridge::
    SetVisibilityState(remote_cocoa::mojom::WindowVisibility     State)

  - DNA-84951 New PiP is completely black for some 2 GPU     setups

  - DNA-85284 Chrome &ldquo;Open link in same tab, pop-up as     tab [Free]&rdquo; extension is no longer working in     Opera

  - DNA-85415 [Mac] Inspect Popup not working

  - DNA-85530 Create API for displaying and triggering     &ldquo;unread&rdquo; mode for messengers from in-app

  - DNA-85537 Let addons.opera.com interact with sidebar     messengers

Update to version 67.0.3575.115

  - CHR-7833 Update chromium on desktop-stable-80-3575 to     80.0.3987.149

  - DNA-74423 [Mac] Search/Copy popup stuck on top left of     screen

  - DNA-82975 Crash at     blink::DocumentLifecycle::EnsureStateAtMost     (blink::DocumentLifecycle::LifecycleState)

  - DNA-83834 Crash at base::MessagePumpNSApplication::
    DoRun (base::MessagePump::Delegate*)

  - DNA-84632 macOS 10.15.2 fail on creating testlist.json

  - DNA-84713 Switching through tabs broken when using     workspaces

This update for chromium fixes the following issues :

Chromium was updated to 81.0.4044.129 (boo#1170107) :

  - CVE-2020-0561: Fixed a use after free in storage

  - CVE-2020-6462: Fixed a use after free in task scheduling

  - CVE-2020-6459: Fixed a use after free in payments

  - CVE-2020-6460: Fixed an insufficient data validation in     URL formatting

  - CVE-2020-6458: Fixed an out of bounds read and write in     PDFium

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1981 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 81.0.4044.129.

    Security Fix(es):

    * chromium-browser: Use after free in storage (CVE-2020-6461)

    * chromium-browser: Use after free in task scheduling (CVE-2020-6462)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 81.0.4044.129. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_04_stable-channel-update-for-desktop_27 advisory.

  - Use after free in task scheduling in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-6462)

  - Use after free in storage in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-6461)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 81.0.4044.129. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_04_stable-channel-update-for-desktop_27 advisory.

  - Use after free in task scheduling in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-6462)

  - Use after free in storage in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-6461)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
208468	CentOS 6 : chromium-browser (RHSA-2020:1981)	Nessus	CentOS Local Security Checks	Local	critical
139060	Microsoft Edge (Chromium) < 81.0.416.68 Multiple Vulnerabilities	Nessus	Windows	Local	critical
138066	Debian DSA-4714-1 : chromium - security update	Nessus	Debian Local Security Checks	Local	critical
136685	Fedora 31 : chromium (2020-da49fbb17c)	Nessus	Fedora Local Security Checks	Local	critical
136677	Fedora 30 : chromium (2020-06c54925d3)	Nessus	Fedora Local Security Checks	Local	critical
136643	GLSA-202005-13 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
136458	openSUSE Security Update : opera (openSUSE-2020-635)	Nessus	SuSE Local Security Checks	Local	critical
136315	openSUSE Security Update : chromium (openSUSE-2020-604)	Nessus	SuSE Local Security Checks	Local	critical
136186	RHEL 6 : chromium-browser (RHSA-2020:1981)	Nessus	Red Hat Local Security Checks	Local	critical
136122	Google Chrome < 81.0.4044.129 Multiple Vulnerabilities	Nessus	Windows	Local	critical
136121	Google Chrome < 81.0.4044.129 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	critical

Detections

Analytics

CVE-2020-6462

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical