Detections
Analytics

FreeBSD : www/chromium -- multiple vulnerabilities (479fdfda-6659-11eb-83e2-e09467587c17)

critical Nessus Plugin ID 146166

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

Chrome Releases reports :

This update include 6 security fixes :

- 1169317] Critical CVE-2021-21142: Use after free in Payments.
Reported by Khalil Zhani on 2021-01-21

- [1163504] High CVE-2021-21143: Heap buffer overflow in Extensions.
Reported by Allen Parker and Alex Morgan of MU on 2021-01-06

- [1163845] High CVE-2021-21144: Heap buffer overflow in Tab Groups.
Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2021-01-07

- [1154965] High CVE-2021-21145: Use after free in Fonts. Reported by Anonymous on 2020-12-03

- [1161705] High CVE-2021-21146: Use after free in Navigation.
Reported by Alison Huffman and Choongwoo Han of Microsoft Browser Vulnerability Research on 2020-12-24

- [1162942] Medium CVE-2021-21147: Inappropriate implementation in Skia. Reported by Roman Starkov on 2021-01-04

Solution

Update the affected package.

See Also

http://www.nessus.org/u?a97ab3be

http://www.nessus.org/u?b829c53c

Plugin Details

Severity: Critical

ID: 146166

File Name: freebsd_pkg_479fdfda665911eb83e2e09467587c17.nasl

Version: 1.3

Type: local

Published: 2/4/2021

Updated: 2/16/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.5

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-21146

CVSS v3

Risk Factor: Critical

Base Score: 9.6

Temporal Score: 8.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:chromium, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Ease: No known exploits are available

Patch Publication Date: 2/3/2021

Vulnerability Publication Date: 2/2/2021

Reference Information

CVE: CVE-2021-21142, CVE-2021-21143, CVE-2021-21144, CVE-2021-21145, CVE-2021-21146, CVE-2021-21147