Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 90.0.4430.93 allowed a remote attacker
    to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21233)

  - Use after free in permissions in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had
    compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2021-21201)

  - Use after free in extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a
    user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome
    Extension. (CVE-2021-21202)

  - Use after free in Blink in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially
    exploit heap corruption via a crafted HTML page. (CVE-2021-21203)

  - Use after free in Blink in Google Chrome on OS X prior to 90.0.4430.72 allowed a remote attacker to
    potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21204)

This update for opera fixes the following issues :

Update to version 76.0.4017.107

  - CHR-8413 Update chromium on desktop-stable-90-4017 to     90.0.4430.93

  - DNA-90168 Display SD suggestions titles

  - DNA-92693 &lsquo;Re-attach tab&rsquo; overlay is not     resized with window

  - DNA-92926 [Mac][Cashback] &ldquo;Close Tab&rdquo; menu     item not greyed out for Cashback corner

  - DNA-92934 Report crashes from opera://crashes and     Tooltip to new Atlassian

  - DNA-92980 Enable tutorials flag on all streams

  - The update to chromium 90.0.4430.93 fixes following     issues: CVE-2021-21227, CVE-2021-21232, CVE-2021-21233,     CVE-2021-21228, CVE-2021-21229, CVE-2021-21230,     CVE-2021-21231

This update for chromium fixes the following issues :

  - Chromium was updated to 90.0.4430.93     (boo#1184764,boo#1185047,boo#1185398)

  - CVE-2021-21227: Insufficient data validation in V8. 

  - CVE-2021-21232: Use after free in Dev Tools. 

  - CVE-2021-21233: Heap buffer overflow in ANGLE.

  - CVE-2021-21228: Insufficient policy enforcement in     extensions.

  - CVE-2021-21229: Incorrect security UI in downloads.

  - CVE-2021-21230: Type Confusion in V8. 

  - CVE-2021-21231: Insufficient data validation in V8.

  - CVE-2021-21222: Heap buffer overflow in V8

  - CVE-2021-21223: Integer overflow in Mojo

  - CVE-2021-21224: Type Confusion in V8

  - CVE-2021-21225: Out of bounds memory access in V8

  - CVE-2021-21226: Use after free in navigation

  - CVE-2021-21201: Use after free in permissions

  - CVE-2021-21202: Use after free in extensions

  - CVE-2021-21203: Use after free in Blink

  - CVE-2021-21204: Use after free in Blink

  - CVE-2021-21205: Insufficient policy enforcement in     navigation

  - CVE-2021-21221: Insufficient validation of untrusted     input in Mojo

  - CVE-2021-21207: Use after free in IndexedDB

  - CVE-2021-21208: Insufficient data validation in QR     scanner

  - CVE-2021-21209: Inappropriate implementation in storage

  - CVE-2021-21210: Inappropriate implementation in Network

  - CVE-2021-21211: Inappropriate implementation in     Navigatio 

  - CVE-2021-21212: Incorrect security UI in Network Config     UI

  - CVE-2021-21213: Use after free in WebMIDI

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2021-21227     Gengming Liu discovered a data validation issue in the     v8 JavaScript library.

  - CVE-2021-21228     Rob Wu discovered a policy enforcement error.

  - CVE-2021-21229     Mohit Raj discovered a user interface error in the file     downloader.

  - CVE-2021-21230     Manfred Paul discovered use of an incorrect type.

  - CVE-2021-21231     Sergei Glazunov discovered a data validation issue in     the v8 JavaScript library.

  - CVE-2021-21232     Abdulrahman Alqabandi discovered a use-after-free issue     in the developer tools.

  - CVE-2021-21233     Omair discovered a buffer overflow issue in the ANGLE     library.

The remote host is affected by the vulnerability described in GLSA-202104-08 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The version of Microsoft Edge installed on the remote Windows host is prior to 90.0.818.51. It is, therefore, affected by multiple vulnerabilities as referenced in the April 29, 2021 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Chrome Releases reports :

This release contains 9 security fixes, including :

- [1199345] High CVE-2021-21227: Insufficient data validation in V8.
Reported by Gengming Liu of Singular Security Lab on 2021-04-15

- [1175058] High CVE-2021-21232: Use after free in Dev Tools. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-05

- [1182937] High CVE-2021-21233: Heap buffer overflow in ANGLE.
Reported by Omair on 2021-02-26

- [1139156] Medium CVE-2021-21228: Insufficient policy enforcement in extensions. Reported by Rob Wu on 2020-10-16

- [$TBD][1198165] Medium CVE-2021-21229: Incorrect security UI in downloads. Reported by Mohit Raj (shadow2639) on 2021-04-12

- [1198705] Medium CVE-2021-21230: Type Confusion in V8. Reported by Manfred Paul on 2021-04-13

- [1198696] Low CVE-2021-21231: Insufficient data validation in V8.
Reported by Sergei Glazunov of Google Project Zero on 2021-04-13

The version of Google Chrome installed on the remote Windows host is prior to 90.0.4430.93. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_04_stable-channel-update-for-desktop_26 advisory.

  - Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 90.0.4430.93 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21233)

  - Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21227, CVE-2021-21231)

  - Use after free in Dev Tools in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21232)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 90.0.4430.93 allowed an attacker     who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted     Chrome Extension. (CVE-2021-21228)

  - Incorrect security UI in downloads in Google Chrome on Android prior to 90.0.4430.93 allowed a remote     attacker to perform domain spoofing via a crafted HTML page. (CVE-2021-21229)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 90.0.4430.93. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_04_stable-channel-update-for-desktop_26 advisory.

  - Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 90.0.4430.93 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21233)

  - Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21227, CVE-2021-21231)

  - Use after free in Dev Tools in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21232)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 90.0.4430.93 allowed an attacker     who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted     Chrome Extension. (CVE-2021-21228)

  - Incorrect security UI in downloads in Google Chrome on Android prior to 90.0.4430.93 allowed a remote     attacker to perform domain spoofing via a crafted HTML page. (CVE-2021-21229)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
406833	Alpine: qt5-qtwebengine: security update to 5.15.3_git20210510-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
406833	Alpine: qt5-qtwebengine: security update to 5.15.3_git20210510-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
150090	openSUSE Security Update : opera (openSUSE-2021-729)	Nessus	SuSE Local Security Checks	Local	high
149603	openSUSE Security Update : Chromium (openSUSE-2021-629)	Nessus	SuSE Local Security Checks	Local	critical
149250	Debian DSA-4911-1 : chromium - security update	Nessus	Debian Local Security Checks	Local	high
149223	GLSA-202104-08 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
149090	Microsoft Edge (Chromium) < 90.0.818.51 Multiple Vulnerabilities	Nessus	Windows	Local	high
149039	FreeBSD : chromium -- multiple vulnerabilities (9fba80e0-a771-11eb-97a0-e09467587c17)	Nessus	FreeBSD Local Security Checks	Local	high
148996	Google Chrome < 90.0.4430.93 Multiple Vulnerabilities	Nessus	Windows	Local	high
148995	Google Chrome < 90.0.4430.93 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	high

Detections

Analytics

CVE-2021-21233

high

Tenable Plugins

critical

critical

high

critical

high

critical

high

high

high

high