RHEL 6 : chromium-browser (RHSA-2019:4238)

high Nessus Plugin ID 132228

Language:

Synopsis

The remote Red Hat host is missing one or more security updates for chromium-browser.

Description

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:4238 advisory.

- chromium-browser: Use after free in Bluetooth (CVE-2019-13725)

- chromium-browser: Heap buffer overflow in password manager (CVE-2019-13726)

- chromium-browser: Insufficient policy enforcement in WebSockets (CVE-2019-13727)

- chromium-browser: Out of bounds write in V8 (CVE-2019-13728, CVE-2019-13735)

- chromium-browser: Use after free in WebSockets (CVE-2019-13729)

- chromium-browser: Type Confusion in V8 (CVE-2019-13730, CVE-2019-13764)

- chromium-browser: Use after free in WebAudio (CVE-2019-13732)

- sqlite: fts3: improve shadow table corruption detection (CVE-2019-13734, CVE-2019-13752)

- chromium-browser: Integer overflow in PDFium (CVE-2019-13736)

- chromium-browser: Insufficient policy enforcement in autocomplete (CVE-2019-13737)

- chromium-browser: Insufficient policy enforcement in navigation (CVE-2019-13738, CVE-2019-13758)

- chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13739, CVE-2019-13742, CVE-2019-13749, CVE-2019-13757, CVE-2019-13761)

- chromium-browser: Incorrect security UI in sharing (CVE-2019-13740)

- chromium-browser: Insufficient validation of untrusted input in Blink (CVE-2019-13741)

- chromium-browser: Incorrect security UI in external protocol handling (CVE-2019-13743)

- chromium-browser: Insufficient policy enforcement in cookies (CVE-2019-13744)

- chromium-browser: Insufficient policy enforcement in audio (CVE-2019-13745)

- chromium-browser: Insufficient policy enforcement in Omnibox (CVE-2019-13746)

- chromium-browser: Uninitialized Use in rendering (CVE-2019-13747)

- chromium-browser: Insufficient policy enforcement in developer tools (CVE-2019-13748)

- sqlite: dropping of shadow tables not restricted in defensive mode (CVE-2019-13750)

- sqlite: fts3: improve detection of corrupted records (CVE-2019-13751)

- sqlite: fts3: incorrectly removed corruption check (CVE-2019-13753)

- chromium-browser: Insufficient policy enforcement in extensions (CVE-2019-13754, CVE-2019-13755)

- chromium-browser: Incorrect security UI in printing (CVE-2019-13756)

- chromium-browser: Incorrect security UI in interstitials (CVE-2019-13759)

- chromium-browser: Insufficient policy enforcement in downloads (CVE-2019-13762)

- chromium-browser: Insufficient policy enforcement in payments (CVE-2019-13763)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the RHEL chromium-browser package based on the guidance in RHSA-2019:4238.

Plugin Details

Severity: High

ID: 132228

File Name: redhat-RHSA-2019-4238.nasl

Version: 1.5

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 12/18/2019

Updated: 4/24/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-13764

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:chromium-browser, cpe:/o:redhat:enterprise_linux:6

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/16/2019

Vulnerability Publication Date: 12/10/2019

Reference Information

CVE: CVE-2019-13725, CVE-2019-13726, CVE-2019-13727, CVE-2019-13728, CVE-2019-13729, CVE-2019-13730, CVE-2019-13732, CVE-2019-13734, CVE-2019-13735, CVE-2019-13736, CVE-2019-13737, CVE-2019-13738, CVE-2019-13739, CVE-2019-13740, CVE-2019-13741, CVE-2019-13742, CVE-2019-13743, CVE-2019-13744, CVE-2019-13745, CVE-2019-13746, CVE-2019-13747, CVE-2019-13748, CVE-2019-13749, CVE-2019-13750, CVE-2019-13751, CVE-2019-13752, CVE-2019-13753, CVE-2019-13754, CVE-2019-13755, CVE-2019-13756, CVE-2019-13757, CVE-2019-13758, CVE-2019-13759, CVE-2019-13761, CVE-2019-13762, CVE-2019-13763, CVE-2019-13764

RHSA: 2019:4238

Detections

Analytics