openSUSE Security Update : chromium (openSUSE-SU-2014:1378-1)

critical Nessus Plugin ID 79267

Language:

Synopsis

The remote openSUSE host is missing a security update.

Description

- Update to Chromium 38.0.2125.101 This update includes 159 security fixes, including 113 relatively minor fixes. Highlighted securtiy fixes are: CVE-2014-3188: A combination of V8 and IPC bugs that can lead to remote code execution outside of the sandbox CVE-2014-3189:
Out-of-bounds read in PDFium CVE-2014-3190:
Use-after-free in Events CVE-2014-3191: Use-after-free in Rendering CVE-2014-3192: Use-after-free in DOM CVE-2014-3193: Type confusion in Session Management CVE-2014-3194: Use-after-free in Web Workers CVE-2014-3195: Information Leak in V8 CVE-2014-3196:
Permissions bypass in Windows Sandbox CVE-2014-3197:
Information Leak in XSS Auditor CVE-2014-3198:
Out-of-bounds read in PDFium CVE-2014-3199: Release Assert in V8 bindings CVE-2014-3200: Various fixes from internal audits, fuzzing and other initiatives

- Drop the build of the Native Client. This is actually not a build as that prebuild binaries are being shipped.
Also Google no longer provides prebuild binaries for the NativeClient for 32bit. Chromium as webbrowser is not affected by this and it bring Chromium inline with the regulations that prebuild binaries should not be shipped.

- toolchaing_linux tarball dropped

- Spec-file cleaned for NaCl stuff

- Added patch no-clang-on-packman.diff to prevent the usage of clang on packman, which is not supported there

Solution

Update the affected chromium packages.

Plugin Details

Severity: Critical

ID: 79267

File Name: openSUSE-2014-634.nasl

Version: 1.6

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 11/17/2014

Updated: 1/19/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:chromedriver, p-cpe:/a:novell:opensuse:chromedriver-debuginfo, p-cpe:/a:novell:opensuse:chromium, p-cpe:/a:novell:opensuse:chromium-debuginfo, p-cpe:/a:novell:opensuse:chromium-debugsource, p-cpe:/a:novell:opensuse:chromium-desktop-gnome, p-cpe:/a:novell:opensuse:chromium-desktop-kde, p-cpe:/a:novell:opensuse:chromium-ffmpegsumo, p-cpe:/a:novell:opensuse:chromium-ffmpegsumo-debuginfo, cpe:/o:novell:opensuse:13.1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Patch Publication Date: 10/31/2014

Reference Information

CVE: CVE-2014-3178, CVE-2014-3188, CVE-2014-3189, CVE-2014-3190, CVE-2014-3191, CVE-2014-3192, CVE-2014-3193, CVE-2014-3194, CVE-2014-3195, CVE-2014-3196, CVE-2014-3197, CVE-2014-3198, CVE-2014-3199, CVE-2014-3200

Detections

Analytics