Google Chrome < 67.0.3396.62 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 700358
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote host is utilizing a web browser that is affected by multiple attack vectors.

Description

The version of Google Chrome installed on the remote host is prior to 67.0.3396.62, and is affected by multiple vulnerabilities :

- A flaw exists in the 'SRIVerifier::DidGetReadable()' function in 'fetch/FetchManager.cpp' that is triggered when handling responses that are invalid for subresource integrity (SRI) validation. This may allow a context-dependent attacker to disclose cross-origin information.
- An out-of-bounds read flaw exists in the 'Decode()' function in 'modules/audio_coding/codecs/isac/main/source/isac.c' that is triggered when decoding iSAC encoded content. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents.
- A flaw exists that is triggered as secure text input is not enabled for password Textfields. This may allow a physically proximate attacker to potentially view entered passwords that are not being obfuscated.
- An out-of-bounds read flaw exists in the 'CPDF_StreamParser::ParseNextElement()' function in 'core/fpdfapi/page/cpdf_streamparser.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose sensitive memory contents.
- An overflow condition exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against the library or potentially allowing the execution of arbitrary code.
- A flaw exists in the 'CSSPaintValue::GetImage()' function in 'blink/renderer/core/css/css_paint_value.cc'. This may allow a context-dependent attacker to disclose information about the page visited status.
- A flaw exists in the 'RenderWidgetHostImpl::WasShown()' function in 'content/browser/renderer_host/render_widget_host_impl.cc'. This may allow a context-dependent attacker to spoof the user interface.
- A flaw exists in the 'PerformanceNavigationTiming::PerformanceNavigationTiming()' function in 'third_party/WebKit/Source/core/timing/PerformanceNavigationTiming.cpp'. This may allow a context-dependent attacker to bypass the referrer policy.
- A flaw exists as it does not properly limit certain problematic characters 'e.g'. Cyrillic Small Letter Palochka (U+04CF) before displaying them as Unicode. With a specially crafted IDN domain, a context-dependent attacker can spoof an omnibox address.
- An out-of-bounds read flaw exists in 'modules/video_coding/rtp_frame_reference_finder.cc' that is triggered when handling VP9 RTP frames. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose sensitive memory contents.
- An out-of-bounds read flaw exists in the 'RtpFrameReferenceFinder::MissingRequiredFrameVp9()' function in 'modules/video_coding/rtp_frame_reference_finder.cc' that is triggered when handling VP9 temporal layers. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose sensitive memory contents.
- A flaw exists that allows a universal cross-site scripting (UXSS) attack. This flaw exists exists because the program does not validate input before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
- A use-after-free error exists in 'content/browser/indexed_db/indexed_db_transaction.cc' that is triggered when handling IndexedDB transactions. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
- A type confusion flaw exists in the 'ReadableStreamBytesConsumer::OnFulfilled()' function in 'blink/renderer/core/fetch/readable_stream_bytes_consumer.cc'. This may allow a context-dependent attacker to potentially execute arbitrary code.

Solution

Upgrade to Chrome version 67.0.3396.62 or later.

See Also

http://www.nessus.org/u?e0ac93e8

Plugin Details

Severity: High

ID: 700358

Family: Web Clients

Published: 8/23/2018

Updated: 3/6/2019

Nessus ID: 110229

Risk Information

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 7.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

Vulnerability Information

CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Patch Publication Date: 1/3/2018

Vulnerability Publication Date: 1/3/2018

Reference Information

CVE: CVE-2018-6124, CVE-2018-6127, CVE-2018-6128, CVE-2018-6129, CVE-2018-6130, CVE-2018-6131, CVE-2018-6133, CVE-2018-6134, CVE-2018-6135, CVE-2018-6136, CVE-2018-6137, CVE-2018-6141, CVE-2018-6142, CVE-2018-6143, CVE-2018-6144, CVE-2018-6145, CVE-2018-6147, CVE-2018-6150

BID: 104309