The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-48866282e5 advisory.

  - Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted SCTP packet. (CVE-2020-16044)

  - Insufficient policy enforcement in Cryptohome in Google Chrome prior to 88.0.4324.96 allowed a local     attacker to perform OS-level privilege escalation via a crafted file. (CVE-2021-21117)

  - Insufficient data validation in V8 in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21118)

  - Use after free in Media in Google Chrome prior to 88.0.4324.96 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-21119)

  - Use after free in WebSQL in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21120)

  - Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21121)

  - Use after free in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21122)

  - Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21123)

  - Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a     remote attacker to potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21124)

  - Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 88.0.4324.96     allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21125)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass site isolation via a crafted Chrome Extension. (CVE-2021-21126)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass content security policy via a crafted Chrome Extension. (CVE-2021-21127)

  - Heap buffer overflow in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21128)

  - Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21129, CVE-2021-21130,     CVE-2021-21131)

  - Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker     to potentially perform a sandbox escape via a crafted Chrome Extension. (CVE-2021-21132)

  - Insufficient policy enforcement in Downloads in Google Chrome prior to 88.0.4324.96 allowed an attacker     who convinced a user to download files to bypass navigation restrictions via a crafted HTML page.
    (CVE-2021-21133)

  - Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker     to spoof security UI via a crafted HTML page. (CVE-2021-21134)

  - Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21135)

  - Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21136)

  - Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker     to obtain potentially sensitive information from disk via a crafted HTML page. (CVE-2021-21137)

  - Use after free in DevTools in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially     perform a sandbox escape via a crafted file. (CVE-2021-21138)

  - Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2021-21139)

  - Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially     perform out of bounds memory access via via a USB device. (CVE-2021-21140)

  - Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass file extension policy via a crafted HTML page. (CVE-2021-21141)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Fedora 33 : chromium (2021-48866282e5)

critical Nessus Plugin ID 145391

Version 1.6