Chromium 60. Security fix for CVE-2017-5091, CVE-2017-5092, CVE-2017-5093, CVE-2017-5094, CVE-2017-5095, CVE-2017-5096, CVE-2017-5097, CVE-2017-5098, CVE-2017-5099, CVE-2017-5100, CVE-2017-5101, CVE-2017-5102, CVE-2017-5103, CVE-2017-5104, CVE-2017-7000, CVE-2017-5105, CVE-2017-5106, CVE-2017-5107, CVE-2017-5108, CVE-2017-5109, CVE-2017-5110.

New subpackage -headless.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Inappropriate implementation in Omnibox in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac     allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page. (CVE-2017-5101)

Note that Nessus relies on the presence of the package as reported by the vendor.

Update to 60.0.3112.113. Added support for aarch64 (except on EPEL7).

----

Update to 60.0.3112.101. Apply upstream fix for cameras reporting 0x0 resolution formats.

----

Chromium 60. Security fix for CVE-2017-5091, CVE-2017-5092, CVE-2017-5093, CVE-2017-5094, CVE-2017-5095, CVE-2017-5096, CVE-2017-5097, CVE-2017-5098, CVE-2017-5099, CVE-2017-5100, CVE-2017-5101, CVE-2017-5102, CVE-2017-5103, CVE-2017-5104, CVE-2017-7000, CVE-2017-5105, CVE-2017-5106, CVE-2017-5107, CVE-2017-5108, CVE-2017-5109, CVE-2017-5110.

New subpackage -headless.

----

Update to 59.0.3071.115

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Google Chrome installed on the remote macOS host is prior to 60.0.3112.78. It is, therefore, affected by multiple vulnerabilities as referenced in the 2017_07_stable-channel-update-for-desktop advisory.

  - An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is     affected. The issue involves the SQLite component. It allows remote attackers to execute arbitrary code     or cause a denial of service (memory corruption and application crash) via a crafted web site.
    (CVE-2017-6991)

  - A use after free in IndexedDB in Google Chrome prior to 60.0.3112.78 for Linux, Android, Windows, and Mac     allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (CVE-2017-5091)

  - Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for     Windows allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2017-5092)

  - Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for     Mac, Windows, Linux, and Android allowed a remote attacker to prevent a full screen warning from being     displayed via a crafted HTML page. (CVE-2017-5093)

  - Type confusion in extensions JavaScript bindings in Google Chrome prior to 60.0.3112.78 for Mac, Windows,     Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted HTML     page. (CVE-2017-5094)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 60.0.3112.78.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2017-5091, CVE-2017-5092, CVE-2017-5093, CVE-2017-5094, CVE-2017-5095, CVE-2017-5096, CVE-2017-5097, CVE-2017-5098, CVE-2017-5099, CVE-2017-5100, CVE-2017-5101, CVE-2017-5102, CVE-2017-5103, CVE-2017-5104, CVE-2017-5106, CVE-2017-7000, CVE-2017-5105, CVE-2017-5107, CVE-2017-5108, CVE-2017-5109, CVE-2017-5110)

Google Chrome releases reports :

40 security fixes in this release

Please reference CVE/URL list for details

The remote host is affected by the vulnerability described in GLSA-201709-15 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the referenced CVE identifiers for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, bypass security restrictions, or spoof content.
  Workaround :

    There is no known workaround at this time.

The version of Google Chrome installed on the remote Windows host is prior to 60.0.3112.78. It is, therefore, affected by multiple vulnerabilities as referenced in the 2017_07_stable-channel-update-for-desktop advisory.

  - An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is     affected. The issue involves the SQLite component. It allows remote attackers to execute arbitrary code     or cause a denial of service (memory corruption and application crash) via a crafted web site.
    (CVE-2017-6991)

  - A use after free in IndexedDB in Google Chrome prior to 60.0.3112.78 for Linux, Android, Windows, and Mac     allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (CVE-2017-5091)

  - Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for     Windows allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2017-5092)

  - Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for     Mac, Windows, Linux, and Android allowed a remote attacker to prevent a full screen warning from being     displayed via a crafted HTML page. (CVE-2017-5093)

  - Type confusion in extensions JavaScript bindings in Google Chrome prior to 60.0.3112.78 for Mac, Windows,     Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted HTML     page. (CVE-2017-5094)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2017-5087     Ned Williamson discovered a way to escape the sandbox.

  - CVE-2017-5088     Xiling Gong discovered an out-of-bounds read issue in     the v8 JavaScript library.

  - CVE-2017-5089     Michal Bentkowski discovered a spoofing issue.

  - CVE-2017-5091     Ned Williamson discovered a use-after-free issue in     IndexedDB.

  - CVE-2017-5092     Yu Zhou discovered a use-after-free issue in PPAPI.

  - CVE-2017-5093     Luan Herrera discovered a user interface spoofing issue.

  - CVE-2017-5094     A type confusion issue was discovered in extensions.

  - CVE-2017-5095     An out-of-bounds write issue was discovered in the     pdfium library.

  - CVE-2017-5097     An out-of-bounds read issue was discovered in the skia     library.

  - CVE-2017-5098     Jihoon Kim discovered a use-after-free issue in the v8     JavaScript library.

  - CVE-2017-5099     Yuan Deng discovered an out-of-bounds write issue in     PPAPI.

  - CVE-2017-5100     A use-after-free issue was discovered in Chrome Apps.

  - CVE-2017-5101     Luan Herrera discovered a URL spoofing issue.

  - CVE-2017-5102     An uninitialized variable was discovered in the skia     library.

  - CVE-2017-5103     Another uninitialized variable was discovered in the     skia library.

  - CVE-2017-5104     Khalil Zhani discovered a user interface spoofing issue.

  - CVE-2017-5105     Rayyan Bijoora discovered a URL spoofing issue.

  - CVE-2017-5106     Jack Zac discovered a URL spoofing issue.

  - CVE-2017-5107     David Kohlbrenner discovered an information leak in SVG     file handling.

  - CVE-2017-5108     Guang Gong discovered a type confusion issue in the     pdfium library.

  - CVE-2017-5109     Jose Maria Acuna Morgado discovered a user interface     spoofing issue.

  - CVE-2017-5110     xisigr discovered a way to spoof the payments dialog.

  - CVE-2017-7000     Chaitin Security Research Lab discovered an information     disclosure issue in the sqlite library.

This update Chromium to version 60.0.3112.78 fixes security issue and bugs.

The following security issues were fixed :

  - CVE-2017-5091: Use after free in IndexedDB

  - CVE-2017-5092: Use after free in PPAPI

  - CVE-2017-5093: UI spoofing in Blink

  - CVE-2017-5094: Type confusion in extensions

  - CVE-2017-5095: Out-of-bounds write in PDFium

  - CVE-2017-5096: User information leak via Android intents

  - CVE-2017-5097: Out-of-bounds read in Skia

  - CVE-2017-5098: Use after free in V8

  - CVE-2017-5099: Out-of-bounds write in PPAPI

  - CVE-2017-5100: Use after free in Chrome Apps

  - CVE-2017-5101: URL spoofing in OmniBox

  - CVE-2017-5102: Uninitialized use in Skia

  - CVE-2017-5103: Uninitialized use in Skia

  - CVE-2017-5104: UI spoofing in browser

  - CVE-2017-7000: Pointer disclosure in SQLite

  - CVE-2017-5105: URL spoofing in OmniBox

  - CVE-2017-5106: URL spoofing in OmniBox

  - CVE-2017-5107: User information leak via SVG

  - CVE-2017-5108: Type confusion in PDFium

  - CVE-2017-5109: UI spoofing in browser

  - CVE-2017-5110: UI spoofing in payments dialog

  - Various fixes from internal audits, fuzzing and other     initiatives

A number of upstream bugfixes are also included in this release.

ID	Name	Product	Family	Published	Updated	Severity
102612	Fedora 26 : chromium (2017-f79ae2b96f)	Nessus	Fedora Local Security Checks	8/21/2017	11/26/2025	high
251506	Linux Distros Unpatched Vulnerability : CVE-2017-5101	Nessus	Misc.	8/18/2025	8/18/2025	medium
103104	Fedora 25 : chromium (2017-c708c044e3)	Nessus	Fedora Local Security Checks	9/11/2017	11/21/2025	high
101981	Google Chrome < 60.0.3112.78 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	7/26/2017	11/24/2025	high
102090	RHEL 6 : chromium-browser (RHSA-2017:1833)	Nessus	Red Hat Local Security Checks	8/1/2017	12/4/2025	high
102101	FreeBSD : chromium -- multiple vulnerabilities (7d138476-7710-11e7-88a1-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	8/2/2017	12/4/2025	high
103443	GLSA-201709-15 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	9/25/2017	11/20/2025	high
101980	Google Chrome < 60.0.3112.78 Multiple Vulnerabilities	Nessus	Windows	7/26/2017	11/24/2025	high
102210	Debian DSA-3926-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	8/7/2017	12/4/2025	high
102054	openSUSE Security Update : chromium (openSUSE-2017-854)	Nessus	SuSE Local Security Checks	7/31/2017	12/4/2025	high

Detections

Analytics

Plugins Search

high

medium

high

high

high

high

high

high

high

high