This update for chromium fixes the following issues :

Chromium was updated to version 80.0.3987.87 (boo#1162833).

Security issues fixed :

  - CVE-2020-6381: Integer overflow in JavaScript     (boo#1162833).

  - CVE-2020-6382: Type Confusion in JavaScript     (boo#1162833).

  - CVE-2019-18197: Multiple vulnerabilities in XML     (boo#1162833).

  - CVE-2019-19926: Inappropriate implementation in SQLite     (boo#1162833).

  - CVE-2020-6385: Insufficient policy enforcement in     storage (boo#1162833).

  - CVE-2019-19880, CVE-2019-19925: Multiple vulnerabilities     in SQLite (boo#1162833).

  - CVE-2020-6387: Out of bounds write in WebRTC     (boo#1162833).

  - CVE-2020-6388: Out of bounds memory access in WebAudio     (boo#1162833).

  - CVE-2020-6389: Out of bounds write in WebRTC     (boo#1162833).

  - CVE-2020-6390: Out of bounds memory access in streams     (boo#1162833).

  - CVE-2020-6391: Insufficient validation of untrusted     input in Blink (boo#1162833).

  - CVE-2020-6392: Insufficient policy enforcement in     extensions (boo#1162833).

  - CVE-2020-6393: Insufficient policy enforcement in Blink     (boo#1162833).

  - CVE-2020-6394: Insufficient policy enforcement in Blink     (boo#1162833).

  - CVE-2020-6395: Out of bounds read in JavaScript     (boo#1162833).

  - CVE-2020-6396: Inappropriate implementation in Skia     (boo#1162833).

  - CVE-2020-6397: Incorrect security UI in sharing     (boo#1162833).

  - CVE-2020-6398: Uninitialized use in PDFium     (boo#1162833).

  - CVE-2020-6399: Insufficient policy enforcement in     AppCache (boo#1162833).

  - CVE-2020-6400: Inappropriate implementation in CORS     (boo#1162833).

  - CVE-2020-6401: Insufficient validation of untrusted     input in Omnibox (boo#1162833).

  - CVE-2020-6402: Insufficient policy enforcement in     downloads (boo#1162833).

  - CVE-2020-6403: Incorrect security UI in Omnibox     (boo#1162833).

  - CVE-2020-6404: Inappropriate implementation in Blink     (boo#1162833).

  - CVE-2020-6405: Out of bounds read in SQLite     (boo#1162833).

  - CVE-2020-6406: Use after free in audio (boo#1162833).

  - CVE-2019-19923: Out of bounds memory access in SQLite     (boo#1162833).

  - CVE-2020-6408: Insufficient policy enforcement in CORS     (boo#1162833).

  - CVE-2020-6409: Inappropriate implementation in Omnibox     (boo#1162833).

  - CVE-2020-6410: Insufficient policy enforcement in     navigation (boo#1162833).

  - CVE-2020-6411: Insufficient validation of untrusted     input in Omnibox (boo#1162833).

  - CVE-2020-6412: Insufficient validation of untrusted     input in Omnibox (boo#1162833).

  - CVE-2020-6413: Inappropriate implementation in Blink     (boo#1162833).

  - CVE-2020-6414: Insufficient policy enforcement in Safe     Browsing (boo#1162833).

  - CVE-2020-6415: Inappropriate implementation in     JavaScript (boo#1162833).

  - CVE-2020-6416: Insufficient data validation in streams     (boo#1162833).

  - CVE-2020-6417: Inappropriate implementation in installer     (boo#1162833).

Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled by default except on NVIDIA.

List of CVEs fixed (since last update) :

  - CVE-2019-20446

  - CVE-2020-6381 

  - CVE-2020-6382 

  - CVE-2020-6383 

  - CVE-2020-6384

  - CVE-2020-6385 

  - CVE-2020-6386

  - CVE-2020-6387 

  - CVE-2020-6388

  - CVE-2020-6389

  - CVE-2020-6390 

  - CVE-2020-6391

  - CVE-2020-6392 

  - CVE-2020-6393

  - CVE-2020-6394

  - CVE-2020-6395

  - CVE-2020-6396 

  - CVE-2020-6397 

  - CVE-2020-6398

  - CVE-2020-6399 

  - CVE-2020-6400 

  - CVE-2020-6401 

  - CVE-2020-6402 

  - CVE-2020-6403 

  - CVE-2020-6404 

  - CVE-2020-6405 

  - CVE-2020-6406 

  - CVE-2020-6407

  - CVE-2020-6408 

  - CVE-2020-6409 

  - CVE-2020-6410 

  - CVE-2020-6411 

  - CVE-2020-6412 

  - CVE-2020-6413 

  - CVE-2020-6414 

  - CVE-2020-6415 

  - CVE-2020-6416 

  - CVE-2020-6417

  - CVE-2020-6418

  - CVE-2020-6420

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Google Chrome installed on the remote macOS host is prior to 80.0.3987.87. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_02_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update to 80.0.3987.149. Upstream says it fixes '13' security issues, but only lists these CVEs :

  - CVE-2020-6422: Use after free in WebGL

  - CVE-2020-6424: Use after free in media

  - CVE-2020-6425: Insufficient policy enforcement in     extensions. 

  - CVE-2020-6426: Inappropriate implementation in V8

  - CVE-2020-6427: Use after free in audio

  - CVE-2020-6428: Use after free in audio

  - CVE-2020-6429: Use after free in audio.

  - CVE-2019-20503: Out of bounds read in usersctplib.

  - CVE-2020-6449: Use after free in audio

----

Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled by default except on NVIDIA.

List of CVEs fixed (since last update) :

  - CVE-2019-20446

  - CVE-2020-6381 

  - CVE-2020-6382 

  - CVE-2020-6383 

  - CVE-2020-6384

  - CVE-2020-6385 

  - CVE-2020-6386

  - CVE-2020-6387 

  - CVE-2020-6388

  - CVE-2020-6389

  - CVE-2020-6390 

  - CVE-2020-6391

  - CVE-2020-6392 

  - CVE-2020-6393

  - CVE-2020-6394

  - CVE-2020-6395

  - CVE-2020-6396 

  - CVE-2020-6397 

  - CVE-2020-6398

  - CVE-2020-6399 

  - CVE-2020-6400 

  - CVE-2020-6401 

  - CVE-2020-6402 

  - CVE-2020-6403 

  - CVE-2020-6404 

  - CVE-2020-6405 

  - CVE-2020-6406 

  - CVE-2020-6407

  - CVE-2020-6408 

  - CVE-2020-6409 

  - CVE-2020-6410 

  - CVE-2020-6411 

  - CVE-2020-6412 

  - CVE-2020-6413 

  - CVE-2020-6414 

  - CVE-2020-6415 

  - CVE-2020-6416 

  - CVE-2020-6417

  - CVE-2020-6418

  - CVE-2020-6420 

----

Update to 79.0.3945.130. Fixes the following security issues :

  - CVE-2020-6378

  - CVE-2020-6379

  - CVE-2020-6380

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Google Chrome installed on the remote Windows host is prior to 80.0.3987.87. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_02_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Microsoft Edge (Chromium) installed on the remote Windows host is prior to 80.0.361.48. It is, therefore, affected by multiple vulnerabilities:

  - An integer overflow condition exists in the JavaScript component of Google Chrome. An unauthenticated,     remote attacker can exploit this, via a crafted HTML page, to potentially exploit heap corruption.
    (CVE-2020-6381)

  - A type confusion error exists in the JavaScript component of Google Chrome. An unauthenticated, remote     attacker can exploit this, via a crafted HTML page, to potentially exploit heap corruption.
    (CVE-2020-6382)

  - A use-after-free vulnerability exists in the speech component of Google Chrome. An unauthenticated, remote     attacker can exploit this, via a crafted HTML page, to potentially exploit heap corruption.
    (CVE-2020-6406)

In addition, Microsoft Edge (Chromium) is also affected by several additional vulnerabilities including additional use-after-free vulnerabilities, out-of-bounds read/write, insufficient input validation, and insufficient policy enforcements.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0514 advisory.

  - libxslt: use after free in xsltCopyText in transform.c could lead to information disclosure     (CVE-2019-18197)

  - sqlite: invalid pointer dereference in exprListAppendList in window.c (CVE-2019-19880)

  - sqlite: mishandling of certain uses of SELECT DISTINCT involving a LEFT JOIN in flattenSubquery in     select.c leads to a NULL pointer dereference (CVE-2019-19923)

  - sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL pathname during an update of a ZIP archive     (CVE-2019-19925)

  - sqlite: error mishandling because of incomplete fix of CVE-2019-19880 (CVE-2019-19926)

  - chromium-browser: Integer overflow in JavaScript (CVE-2020-6381)

  - chromium-browser: Type Confusion in JavaScript (CVE-2020-6382)

  - chromium-browser: Insufficient policy enforcement in storage (CVE-2020-6385)

  - chromium-browser: Out of bounds write in WebRTC (CVE-2020-6387, CVE-2020-6389)

  - chromium-browser: Out of bounds memory access in WebAudio (CVE-2020-6388)

  - chromium-browser: Out of bounds memory access in streams (CVE-2020-6390)

  - chromium-browser: Insufficient validation of untrusted input in Blink (CVE-2020-6391)

  - chromium-browser: Insufficient policy enforcement in extensions (CVE-2020-6392)

  - chromium-browser: Insufficient policy enforcement in Blink (CVE-2020-6393, CVE-2020-6394)

  - chromium-browser: Out of bounds read in JavaScript (CVE-2020-6395)

  - chromium-browser: Inappropriate implementation in Skia (CVE-2020-6396)

  - chromium-browser: Incorrect security UI in sharing (CVE-2020-6397)

  - chromium-browser: Uninitialized use in PDFium (CVE-2020-6398)

  - chromium-browser: Insufficient policy enforcement in AppCache (CVE-2020-6399)

  - chromium-browser: Inappropriate implementation in CORS (CVE-2020-6400)

  - chromium-browser: Insufficient validation of untrusted input in Omnibox (CVE-2020-6401, CVE-2020-6411,     CVE-2020-6412)

  - chromium-browser: Insufficient policy enforcement in downloads (CVE-2020-6402)

  - chromium-browser: Incorrect security UI in Omnibox (CVE-2020-6403)

  - chromium-browser: Inappropriate implementation in Blink (CVE-2020-6404, CVE-2020-6413)

  - sqlite: Out-of-bounds read in SELECT with ON/USING clause (CVE-2020-6405)

  - chromium-browser: Use after free in audio (CVE-2020-6406)

  - chromium-browser: Insufficient policy enforcement in CORS (CVE-2020-6408)

  - chromium-browser: Inappropriate implementation in Omnibox (CVE-2020-6409)

  - chromium-browser: Insufficient policy enforcement in navigation (CVE-2020-6410)

  - chromium-browser: Insufficient policy enforcement in Safe Browsing (CVE-2020-6414)

  - chromium-browser: Inappropriate implementation in JavaScript (CVE-2020-6415)

  - chromium-browser: Insufficient data validation in streams (CVE-2020-6416)

  - chromium-browser: Inappropriate implementation in installer (CVE-2020-6417)

  - chromium-browser: Inappropriate implementation in AppCache (CVE-2020-6499)

  - chromium-browser: Inappropriate implementation in interstitials (CVE-2020-6500)

  - chromium-browser: Insufficient policy enforcement in CSP (CVE-2020-6501)

  - chromium-browser: Incorrect security UI in permissions (CVE-2020-6502)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
133593	openSUSE Security Update : chromium (openSUSE-2020-189)	Nessus	SuSE Local Security Checks	2/10/2020	4/4/2022	high
134718	Fedora 31 : chromium (2020-f6271d7afa)	Nessus	Fedora Local Security Checks	3/20/2020	12/6/2022	high
133464	Google Chrome < 80.0.3987.87 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2/4/2020	4/27/2022	high
134990	Fedora 30 : chromium (2020-39e0b8bd14)	Nessus	Fedora Local Security Checks	3/30/2020	12/6/2022	high
133465	Google Chrome < 80.0.3987.87 Multiple Vulnerabilities	Nessus	Windows	2/4/2020	4/27/2022	high
138174	Microsoft Edge (Chromium) < 80.0.361.48 Multiple Vulnerabilities	Nessus	Windows	7/7/2020	4/26/2022	high
133749	RHEL 6 : chromium-browser (RHSA-2020:0514)	Nessus	Red Hat Local Security Checks	2/18/2020	4/28/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high