RHEL 6 : chromium-browser (RHSA-2020:3377)

High Nessus Plugin ID 139467

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 7.4

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3377 advisory.

- chromium-browser: Heap buffer overflow in background fetch (CVE-2020-6510)

- chromium-browser: Side-channel information leakage in content security policy (CVE-2020-6511)

- chromium-browser: Type Confusion in V8 (CVE-2020-6512, CVE-2020-6533, CVE-2020-6537)

- chromium-browser: Heap buffer overflow in PDFium (CVE-2020-6513)

- chromium-browser: Inappropriate implementation in WebRTC (CVE-2020-6514, CVE-2020-6529)

- chromium-browser: Use after free in tab strip (CVE-2020-6515)

- chromium-browser: Policy bypass in CORS (CVE-2020-6516)

- chromium-browser: Heap buffer overflow in history (CVE-2020-6517)

- chromium-browser: Use after free in developer tools (CVE-2020-6518)

- chromium-browser: Policy bypass in CSP (CVE-2020-6519)

- chromium-browser: Heap buffer overflow in Skia (CVE-2020-6520, CVE-2020-6525, CVE-2020-6540)

- chromium-browser: Side-channel information leakage in autofill (CVE-2020-6521)

- chromium-browser: Inappropriate implementation in external protocol handlers (CVE-2020-6522)

- chromium-browser: Out of bounds write in Skia (CVE-2020-6523)

- chromium-browser: Heap buffer overflow in WebAudio (CVE-2020-6524)

- chromium-browser: Inappropriate implementation in iframe sandbox (CVE-2020-6526)

- chromium-browser: Insufficient policy enforcement in CSP (CVE-2020-6527)

- chromium-browser: Incorrect security UI in basic auth (CVE-2020-6528)

- chromium-browser: Out of bounds memory access in developer tools (CVE-2020-6530)

- chromium-browser: Side-channel information leakage in scroll to text (CVE-2020-6531)

- chromium-browser: Use after free in SCTP (CVE-2020-6532)

- chromium-browser: Heap buffer overflow in WebRTC (CVE-2020-6534)

- chromium-browser: Insufficient data validation in WebUI (CVE-2020-6535)

- chromium-browser: Incorrect security UI in PWAs (CVE-2020-6536)

- chromium-browser: Inappropriate implementation in WebView (CVE-2020-6538)

- chromium-browser: Use after free in CSS (CVE-2020-6539)

- chromium-browser: Use after free in WebUSB (CVE-2020-6541)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected chromium-browser package.

CVE: CVE-2020-6510, CVE-2020-6511, CVE-2020-6512, CVE-2020-6513, CVE-2020-6514, CVE-2020-6515, CVE-2020-6516, CVE-2020-6517, CVE-2020-6518, CVE-2020-6519, CVE-2020-6520, CVE-2020-6521, CVE-2020-6522, CVE-2020-6523, CVE-2020-6524, CVE-2020-6525, CVE-2020-6526, CVE-2020-6527, CVE-2020-6528, CVE-2020-6529, CVE-2020-6530, CVE-2020-6531, CVE-2020-6532, CVE-2020-6533, CVE-2020-6534, CVE-2020-6535, CVE-2020-6536, CVE-2020-6537, CVE-2020-6538, CVE-2020-6539, CVE-2020-6540, CVE-2020-6541

RHSA: 2020:3377

CWE: 122, 358, 416, 843

RHEL 6 : chromium-browser (RHSA-2020:3377)

High Nessus Plugin ID 139467

New! Vulnerability Priority Rating (VPR)

Synopsis

Description

Solution

See Also

Plugin Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerability Information

Reference Information