Debian DSA-4395-1 : chromium - security update

medium Nessus Plugin ID 122272

Language:

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.

VPR Score: 8.4

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities have been discovered in the chromium web browser.

- CVE-2018-17481 A use-after-free issue was discovered in the pdfium library.

- CVE-2019-5754 Klzgrad discovered an error in the QUIC networking implementation.

- CVE-2019-5755 Jay Bosamiya discovered an implementation error in the v8 JavaScript library.

- CVE-2019-5756 A use-after-free issue was discovered in the pdfium library.

- CVE-2019-5757 Alexandru Pitis discovered a type confusion error in the SVG image format implementation.

- CVE-2019-5758 Zhe Jin discovered a use-after-free issue in blink/webkit.

- CVE-2019-5759 Almog Benin discovered a use-after-free issue when handling HTML pages containing select elements.

- CVE-2019-5760 Zhe Jin discovered a use-after-free issue in the WebRTC implementation.

- CVE-2019-5762 A use-after-free issue was discovered in the pdfium library.

- CVE-2019-5763 Guang Gon discovered an input validation error in the v8 JavaScript library.

- CVE-2019-5764 Eyal Itkin discovered a use-after-free issue in the WebRTC implementation.

- CVE-2019-5765 Sergey Toshin discovered a policy enforcement error.

- CVE-2019-5766 David Erceg discovered a policy enforcement error.

- CVE-2019-5767 Haoran Lu, Yifan Zhang, Luyi Xing, and Xiaojing Liao reported an error in the WebAPKs user interface.

- CVE-2019-5768 Rob Wu discovered a policy enforcement error in the developer tools.

- CVE-2019-5769 Guy Eshel discovered an input validation error in blink/webkit.

- CVE-2019-5770 hemidallt discovered a buffer overflow issue in the WebGL implementation.

- CVE-2019-5772 Zhen Zhou discovered a use-after-free issue in the pdfium library.

- CVE-2019-5773 Yongke Wong discovered an input validation error in the IndexDB implementation.

- CVE-2019-5774 Junghwan Kang and Juno Im discovered an input validation error in the SafeBrowsing implementation.

- CVE-2019-5775 evil1m0 discovered a policy enforcement error.

- CVE-2019-5776 Lnyas Zhang discovered a policy enforcement error.

- CVE-2019-5777 Khalil Zhani discovered a policy enforcement error.

- CVE-2019-5778 David Erceg discovered a policy enforcement error in the Extensions implementation.

- CVE-2019-5779 David Erceg discovered a policy enforcement error in the ServiceWorker implementation.

- CVE-2019-5780 Andreas Hegenberg discovered a policy enforcement error.

- CVE-2019-5781 evil1m0 discovered a policy enforcement error.

- CVE-2019-5782 Qixun Zhao discovered an implementation error in the v8 JavaScript library.

- CVE-2019-5783 Shintaro Kobori discovered an input validation error in the developer tools.

- CVE-2019-5784 Lucas Pinheiro discovered an implementation error in the v8 JavaScript library.

Solution

Upgrade the chromium packages.

For the stable distribution (stretch), these problems have been fixed in version 72.0.3626.96-1~deb9u1.

Plugin Details

Severity: Medium

ID: 122272

File Name: debian_DSA-4395.nasl

Version: 1.4

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 2/19/2019

Updated: 2/13/2020

Dependencies: ssh_get_info.nasl

Risk Information

Risk Factor: Medium

VPR Score: 8.4

CVSS Score Source: CVE-2019-5783

CVSS v2.0

Base Score: 6.8

Temporal Score: 5

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:chromium, cpe:/o:debian:debian_linux:9.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 2/18/2019

Vulnerability Publication Date: 12/11/2018

Reference Information

CVE: CVE-2018-17481, CVE-2019-5754, CVE-2019-5755, CVE-2019-5756, CVE-2019-5757, CVE-2019-5758, CVE-2019-5759, CVE-2019-5760, CVE-2019-5762, CVE-2019-5763, CVE-2019-5764, CVE-2019-5765, CVE-2019-5766, CVE-2019-5767, CVE-2019-5768, CVE-2019-5769, CVE-2019-5770, CVE-2019-5772, CVE-2019-5773, CVE-2019-5774, CVE-2019-5775, CVE-2019-5776, CVE-2019-5777, CVE-2019-5778, CVE-2019-5779, CVE-2019-5780, CVE-2019-5781, CVE-2019-5782, CVE-2019-5783, CVE-2019-5784

DSA: 4395