The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2017:2676 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 61.0.3163.79.

    Security Fix(es):

    * Multiple flaws were found in the processing of malformed web content. A web page containing malicious     content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when     visited by the victim. (CVE-2017-5111, CVE-2017-5112, CVE-2017-5113, CVE-2017-5114, CVE-2017-5115,     CVE-2017-5116, CVE-2017-5117, CVE-2017-5118, CVE-2017-5119, CVE-2017-5120)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2017-5111     Luat Nguyen discovered a use-after-free issue in the     pdfium library.

  - CVE-2017-5112     Tobias Klein discovered a buffer overflow issue in the     webgl library.

  - CVE-2017-5113     A buffer overflow issue was discovered in the skia     library.

  - CVE-2017-5114     Ke Liu discovered a memory issue in the pdfium library.

  - CVE-2017-5115     Marco Giovannini discovered a type confusion issue in     the v8 JavaScript library.

  - CVE-2017-5116     Guang Gong discovered a type confusion issue in the v8     JavaScript library.

  - CVE-2017-5117     Tobias Klein discovered an uninitialized value in the     skia library.

  - CVE-2017-5118     WenXu Wu discovered a way to bypass the Content Security     Policy.

  - CVE-2017-5119     Another uninitialized value was discovered in the skia     library.

  - CVE-2017-5120     Xiaoyin Liu discovered a way downgrade HTTPS connections     during redirection.

  - CVE-2017-5121     Jordan Rabet discovered an out-of-bounds memory access     in the v8 JavaScript library.

  - CVE-2017-5122     Choongwoo Han discovered an out-of-bounds memory access     in the v8 JavaScript library.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81     for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
    (CVE-2017-5116)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for chromium to version 61.0.3163.79 fixes several issues.

These security issues were fixed :

  - CVE-2017-5111: Use after free in PDFium (boo#1057364).

  - CVE-2017-5112: Heap buffer overflow in WebGL     (boo#1057364).

  - CVE-2017-5113: Heap buffer overflow in Skia     (boo#1057364).

  - CVE-2017-5114: Memory lifecycle issue in PDFium     (boo#1057364).

  - CVE-2017-5115: Type confusion in V8 (boo#1057364).

  - CVE-2017-5116: Type confusion in V8 (boo#1057364).

  - CVE-2017-5117: Use of uninitialized value in Skia     (boo#1057364).

  - CVE-2017-5118: Bypass of Content Security Policy in     Blink (boo#1057364).

  - CVE-2017-5119: Use of uninitialized value in Skia     (boo#1057364).

  - CVE-2017-5120: Potential HTTPS downgrade during redirect     navigation (boo#1057364).

The version of Google Chrome installed on the remote macOS host is prior to 61.0.3163.79. It is, therefore, affected by multiple vulnerabilities as referenced in the 2017_09_stable-channel-update-for-desktop advisory.

  - Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81     for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
    (CVE-2017-5116)

  - A use after free in PDFium in Google Chrome prior to 61.0.3163.79 for Linux, Windows, and Mac allowed a     remote attacker to potentially exploit memory corruption via a crafted PDF file. (CVE-2017-5111)

  - Heap buffer overflow in WebGL in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote attacker     to execute arbitrary code inside a sandbox via a crafted HTML page. (CVE-2017-5112)

  - Math overflow in Skia in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81     for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2017-5113)

  - Inappropriate use of partition alloc in PDFium in Google Chrome prior to 61.0.3163.79 for Linux, Windows,     and Mac, and 61.0.3163.81 for Android, allowed a remote attacker to potentially exploit memory corruption     via a crafted PDF file. (CVE-2017-5114)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 61.0.3163.100. Security fix for CVE-2017-5111, CVE-2017-5112, CVE-2017-5113, CVE-2017-5114, CVE-2017-5115, CVE-2017-5116, CVE-2017-5117, CVE-2017-5118, CVE-2017-5119, CVE-2017-5120, CVE-2017-5121, CVE-2017-5122

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201709-15 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the referenced CVE identifiers for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, bypass security restrictions, or spoof content.
  Workaround :

    There is no known workaround at this time.

Google Chrome releases reports :

22 security fixes in this release, including :

- [737023] High CVE-2017-5111: Use after free in PDFium. Reported by Luat Nguyen on KeenLab, Tencent on 2017-06-27

- [740603] High CVE-2017-5112: Heap buffer overflow in WebGL. Reported by Tobias Klein on 2017-07-10

- [747043] High CVE-2017-5113: Heap buffer overflow in Skia. Reported by Anonymous on 2017-07-20

- [752829] High CVE-2017-5114: Memory life cycle issue in PDFium.
Reported by Ke Liu of Tencent's Xuanwu LAB on 2017-08-07

- [744584] High CVE-2017-5115: Type confusion in V8. Reported by Marco Giovannini on 2017-07-17

- [759624] High CVE-2017-5116: Type confusion in V8. Reported by Anonymous on 2017-08-28

- [739190] Medium CVE-2017-5117: Use of uninitialized value in Skia.
Reported by Tobias Klein on 2017-07-04

- [747847] Medium CVE-2017-5118: Bypass of Content Security Policy in Blink. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-07-24

- [725127] Medium CVE-2017-5119: Use of uninitialized value in Skia.
Reported by Anonymous on 2017-05-22

- [718676] Low CVE-2017-5120: Potential HTTPS downgrade during redirect navigation. Reported by Xiaoyin Liu on 2017-05-05

- [762099] Various fixes from internal audits, fuzzing and other initiatives

The version of Google Chrome installed on the remote Windows host is prior to 61.0.3163.79. It is, therefore, affected by multiple vulnerabilities as referenced in the 2017_09_stable-channel-update-for-desktop advisory.

  - Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81     for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
    (CVE-2017-5116)

  - A use after free in PDFium in Google Chrome prior to 61.0.3163.79 for Linux, Windows, and Mac allowed a     remote attacker to potentially exploit memory corruption via a crafted PDF file. (CVE-2017-5111)

  - Heap buffer overflow in WebGL in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote attacker     to execute arbitrary code inside a sandbox via a crafted HTML page. (CVE-2017-5112)

  - Math overflow in Skia in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81     for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2017-5113)

  - Inappropriate use of partition alloc in PDFium in Google Chrome prior to 61.0.3163.79 for Linux, Windows,     and Mac, and 61.0.3163.81 for Android, allowed a remote attacker to potentially exploit memory corruption     via a crafted PDF file. (CVE-2017-5114)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
103119	RHEL 6 : chromium-browser (RHSA-2017:2676)	Nessus	Red Hat Local Security Checks	9/12/2017	11/21/2025	high
103539	Debian DSA-3985-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	9/29/2017	11/19/2025	high
251768	Linux Distros Unpatched Vulnerability : CVE-2017-5116	Nessus	Misc.	8/19/2025	8/19/2025	high
103283	openSUSE Security Update : chromium (openSUSE-2017-1047)	Nessus	SuSE Local Security Checks	9/18/2017	11/21/2025	high
102994	Google Chrome < 61.0.3163.79 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	9/7/2017	11/24/2025	high
103907	Fedora 26 : chromium (2017-efeb59171d)	Nessus	Fedora Local Security Checks	10/18/2017	11/18/2025	high
103443	GLSA-201709-15 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	9/25/2017	11/20/2025	high
102988	FreeBSD : chromium -- multiple vulnerabilities (e1100e63-92f7-11e7-bd95-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	9/7/2017	11/24/2025	high
105815	Fedora 27 : chromium (2017-109f8db088)	Nessus	Fedora Local Security Checks	1/15/2018	11/6/2025	high
102993	Google Chrome < 61.0.3163.79 Multiple Vulnerabilities	Nessus	Windows	9/7/2017	11/24/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high