Debian DSA-4340-1 : chromium-browser - security update

Medium Nessus Plugin ID 119018

Synopsis

The remote Debian host is missing a security-related update.

Description

An out-of-bounds bounds memory access issue was discovered in chromium's v8 JavaScript library by cloudfuzzer.

This update also fixes two problems introduced by the previous security upload. Support for arm64 has been restored and gconf-service is no longer a package dependency.

Solution

Upgrade the chromium-browser packages.

For the stable distribution (stretch), this problem has been fixed in version 70.0.3538.102-1~deb9u1.

See Also

http://www.nessus.org/u?e33901a2

https://packages.debian.org/source/stretch/chromium-browser

https://www.debian.org/security/2018/dsa-4340

Plugin Details

Severity: Medium

ID: 119018

File Name: debian_DSA-4340.nasl

Version: 1.2

Type: local

Agent: unix

Published: 2018/11/19

Updated: 2019/07/01

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS v3.0

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:chromium-browser, cpe:/o:debian:debian_linux:9.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 2018/11/18

Vulnerability Publication Date: 2019/06/27

Reference Information

CVE: CVE-2018-17478

DSA: 4340