The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5881-1 advisory.

  - Use after free in WebTransport in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-0471)

  - Use after free in WebRTC in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-0472)

  - Type Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)     (CVE-2023-0473)

  - Use after free in GuestView in Google Chrome prior to 109.0.5414.119 allowed an attacker who convinced a     user to install a malicious extension to potentially exploit heap corruption via a Chrome web app.
    (Chromium security severity: Medium) (CVE-2023-0474)

  - Type confusion in V8 in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-0696)

  - Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to perform     an out of bounds memory read via a crafted HTML page. (Chromium security severity: High) (CVE-2023-0698)

  - Use after free in GPU in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page and browser shutdown. (Chromium security severity: Medium)     (CVE-2023-0699)

  - Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker     to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security     severity: Medium) (CVE-2023-0700)

  - Heap buffer overflow in WebUI in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who     convinced a user to engage in specific UI interactions to potentially exploit heap corruption via UI     interaction . (Chromium security severity: Medium) (CVE-2023-0701)

  - Type confusion in Data Transfer in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who     convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a     crafted HTML page. (Chromium security severity: Medium) (CVE-2023-0702)

  - Type confusion in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced     a user to engage in specific UI interactions to potentially exploit heap corruption via UI interactions.
    (Chromium security severity: Medium) (CVE-2023-0703)

  - Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote     attacker to bypass same origin policy and proxy settings via a crafted HTML page. (Chromium security     severity: Low) (CVE-2023-0704)

  - Integer overflow in Core in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who had one a     race condition to potentially exploit heap corruption via a crafted HTML page. (Chromium security     severity: Low) (CVE-2023-0705)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 18.04 LTS : Chromium vulnerabilities (USN-5881-1)

high Nessus Plugin ID 171733

Version 1.1

Version 1.0

Version 1.1 Oct 23, 2023, 6:27 PM CVSSv2 score source (changed from "CVE-2023-0699" to "CVE-2023-0703") CVSSv3 score source (changed from "CVE-2023-0703" to "None") Detection Exploit attributes ("Exploit available" set to "False") Plugin Feed: 202310231827
Version 1.0 Feb 22, 2023, 1:58 AM New Plugin Feed: 202302220158