openSUSE Security Update : Chromium (openSUSE-2018-759)

High Nessus Plugin ID 111345

Synopsis

The remote openSUSE host is missing a security update.

Description

This update for Chromium to version 67.0.3396.99 fixes multiple issues.

Security issues fixed (bsc#1095163) :

- CVE-2018-6123: Use after free in Blink

- CVE-2018-6124: Type confusion in Blink

- CVE-2018-6125: Overly permissive policy in WebUSB

- CVE-2018-6126: Heap buffer overflow in Skia

- CVE-2018-6127: Use after free in indexedDB

- CVE-2018-6129: Out of bounds memory access in WebRTC

- CVE-2018-6130: Out of bounds memory access in WebRTC

- CVE-2018-6131: Incorrect mutability protection in WebAssembly

- CVE-2018-6132: Use of uninitialized memory in WebRTC

- CVE-2018-6133: URL spoof in Omnibox

- CVE-2018-6134: Referrer Policy bypass in Blink

- CVE-2018-6135: UI spoofing in Blink

- CVE-2018-6136: Out of bounds memory access in V8

- CVE-2018-6137: Leak of visited status of page in Blink

- CVE-2018-6138: Overly permissive policy in Extensions

- CVE-2018-6139: Restrictions bypass in the debugger extension API

- CVE-2018-6140: Restrictions bypass in the debugger extension API

- CVE-2018-6141: Heap buffer overflow in Skia

- CVE-2018-6142: Out of bounds memory access in V8

- CVE-2018-6143: Out of bounds memory access in V8

- CVE-2018-6144: Out of bounds memory access in PDFium

- CVE-2018-6145: Incorrect escaping of MathML in Blink

- CVE-2018-6147: Password fields not taking advantage of OS protections in Views

- CVE-2018-6148: Incorrect handling of CSP header (boo#1096508)

- CVE-2018-6149: Out of bounds write in V8 (boo#1097452)

The following tracked packaging changes are included :

- Require ffmpeg >= 4.0 (boo#1095545)

Solution

Update the affected Chromium packages.

See Also

https://bugzilla.opensuse.org/show_bug.cgi?id=1070421

https://bugzilla.opensuse.org/show_bug.cgi?id=1093031

https://bugzilla.opensuse.org/show_bug.cgi?id=1095163

https://bugzilla.opensuse.org/show_bug.cgi?id=1095545

https://bugzilla.opensuse.org/show_bug.cgi?id=1096508

https://bugzilla.opensuse.org/show_bug.cgi?id=1097452

Plugin Details

Severity: High

ID: 111345

File Name: openSUSE-2018-759.nasl

Version: 1.1

Type: local

Agent: unix

Published: 2018/07/26

Modified: 2018/07/26

Dependencies: 12634

Risk Information

Risk Factor: High

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:chromedriver, p-cpe:/a:novell:opensuse:chromedriver-debuginfo, p-cpe:/a:novell:opensuse:chromium, p-cpe:/a:novell:opensuse:chromium-debuginfo, p-cpe:/a:novell:opensuse:chromium-debugsource, cpe:/o:novell:opensuse:15.0, cpe:/o:novell:opensuse:42.3

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Patch Publication Date: 2018/07/25

Reference Information

CVE: CVE-2018-6123, CVE-2018-6124, CVE-2018-6125, CVE-2018-6126, CVE-2018-6127, CVE-2018-6128, CVE-2018-6129, CVE-2018-6130, CVE-2018-6131, CVE-2018-6132, CVE-2018-6133, CVE-2018-6134, CVE-2018-6135, CVE-2018-6136, CVE-2018-6137, CVE-2018-6138, CVE-2018-6139, CVE-2018-6140, CVE-2018-6141, CVE-2018-6142, CVE-2018-6143, CVE-2018-6144, CVE-2018-6145, CVE-2018-6147, CVE-2018-6148, CVE-2018-6149