Google Chrome < 64.0.3282.119 Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 700352
Synopsis
The remote host is utilizing a web browser that is affected by multiple attack vectors.Description
The version of Google Chrome installed on the remote host is prior to 64.0.3282.119, and is affected by multiple vulnerabilities :- An integer overflow condition exists in the 'Runtime_RegExpReplace()' function in 'runtime/runtime-regexp.cc' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a heap-based buffer overflow and potentially execute arbitrary code.
- An out-of-bounds read flaw exists in the 'JumpTableTargetOffsets::iterator::UpdateAndAdvanceToValid()' function in 'interpreter/bytecode-array-accessor.cc' that is triggered when accessing a bytecode jump table. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents.
- An out-of-bounds read flaw exists in the 'parse_opus_ts_header()' function in 'libavcodec/opus_parser.c' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents.
- A flaw exists in the 'WebUsbDetector::OnDeviceAdded()' function in 'usb/web_usb_detector.cc' that is triggered when displaying RTL languages in WebUSB notifications. This may allow a context-dependent attacker to cause the URL to be somewhat improperly displayed.- An assertion flaw exists in the 'DateFormat::format()' function that is triggered when handling Nan and Infinity dates. This may allow a context-dependent attacker to cause a process linked against the library to terminate.
- A flaw exists as it does not properly limit certain problematic characters 'e.g'. Malaylam U+0D1F letters before displaying them as Unicode. With a specially crafted IDN domain, a context-dependent attacker can more easily spoof an omnibox address.
- A flaw exists in the 'NavigationControllerImpl::RendererDidNavigateToExistingPage()' function in 'frame_host/navigation_controller_impl.cc' that is triggered when managing SSL state while navigating to an existing insecure page that redirected to a secure page. This may allow a context-dependent attacker to cause the SSL state to be lost.
- A flaw exists in the 'TopSitesImpl::SetTopSites()' function in 'components/history/core/browser/top_sites_impl.cc' that is triggered as clearing all browsing data retains page thumbnails in New Tab Page. This may allow a local attacker to disclose visited pages even when such information should have been deleted.
- A flaw exists that is triggered when handling IP addresses from mDNS / cast channel requests. This may allow an attacker to gain unauthorized access to a cast device.
- An out-of-bounds read flaw exists in the 'TemplateURLParsingContext::ProcessURLParams()' function in 'components/search_engines/template_url_parser.cc' that is triggered when handling invalid template URLs. This may allow a context-dependent attacker to potentially disclose memory contents.
- A flaw exists that is triggered when handling frames. This may allow a context-dependent attacker to bypass HTML sandbox restrictions.
- A flaw exists in the 'Event::Deserialize()' function in 'mojo/edk/system/ports/event.cc' that is triggered when calculating mojo event message data sizes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
- A type confusion flaw exists in the 'JSBuiltinReducer::ReduceObjectCreate()' function in 'compiler/js-builtin-reducer.cc' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to potentially execute arbitrary code.
- An overflow condition exists that is triggered when handling bitstream audio in the IPC layer.
Solution
Upgrade to Chrome version 64.0.3282.119 or later.See Also
Plugin Details
Severity: High
ID: 700352
Family: Web Clients
Published: 8/23/2018
Updated: 3/6/2019
Risk Information
Risk Factor: High
CVSS v2.0
Base Score: 7.1
Temporal Score: 6.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:N/A:N
Temporal Vector: CVSS2#E:ND/RL:OF/RC:C
Vulnerability Information
CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Patch Publication Date: 1/24/2018
Vulnerability Publication Date: 10/16/2017
Reference Information
CVE: CVE-2017-16534, CVE-2017-16538, CVE-2017-16525, CVE-2017-16527, CVE-2017-16529, CVE-2017-16531, CVE-2017-16535, CVE-2017-16537, CVE-2017-3738, CVE-2017-16533, CVE-2017-16528, CVE-2017-16526, CVE-2017-16530, CVE-2017-16532, CVE-2017-15420, CVE-2018-6031, CVE-2018-6032, CVE-2018-6033, CVE-2018-6034, CVE-2018-6035, CVE-2018-6036, CVE-2018-6037, CVE-2018-6038, CVE-2018-6039, CVE-2018-6040, CVE-2018-6041, CVE-2018-6042, CVE-2018-6043, CVE-2018-6045, CVE-2018-6046, CVE-2018-6047, CVE-2018-6048, CVE-2018-6049, CVE-2018-6050, CVE-2018-6051, CVE-2018-6052, CVE-2018-6053, CVE-2018-6055