Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to gain code execution via a malicious server.

Update to Chromium 65. For EPEL7, it has been a long time since a successful build has been possible, so this will fix a LOT of CVEs.

CVE-2017-15396 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15422 CVE-2018-6056 CVE-2018-6406 CVE-2018-6057 CVE-2018-6058 CVE-2018-6059 CVE-2018-6060 CVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065 CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070 CVE-2018-6071

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Google Chrome installed on the remote host is prior to 63.0.3239.84, and is affected by multiple vulnerabilities :

 - An out-of-bounds read flaw exists in the 'StoreFrame()' function in 'demux/demux.c' that is triggered when handling animated WebP images with small frames. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents.
 - A flaw exists related to cache storage. This may allow a context-dependent attacker to disclose service worker response sizes.
 - An out-of-bounds read flaw exists that is triggered when rendering the P4_INTARRAY argument to the OP_IntegrityCk opcode in the output of EXPLAIN. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents.
 - An out-of-bounds read flaw exists in 'net/dns/dns_transaction.cc' that is triggered when handling asynchronous DNS exchanges. With specially crafted DNS responses, a context-dependent attacker can potentially disclose memory contents.
 - A flaw exists in the 'PreParser::RewriteCatchPattern()' function in 'parsing/preparser.h' that is triggered as catch variables are not properly handled during block function hoisting. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'MediaElementEventListener::handleEvent()' function in 'modules/mediacapturefromelement/HTMLMediaElementCapture.cpp' that is triggered when handling media streams. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists that is triggered when handling calls to the 'Reflect.'construct'()' JavaScript method. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in 'chrome/android/java/src/org/chromium/chrome/browser/omnibox/UrlBar.java' and 'chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarPhone.java' that is triggered when handling omnibox URL eliding / positioning. This may allow a context-dependent attacker to conduct a spoofing attack.
 - A type confusion flaw exists in the 'TranslatedState::CapturedObjectMaterializer()' function in 'deoptimizer.cc' that is triggered when mutable heap numbers are used in an object field. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in 'chrome/browser/resources/chromeos/login/oobe_screen_terms_of_service.js' that is triggered as content from the web is loaded within the privileged WebUI process when displaying the Terms of Service text. This may allow a context-dependent attacker to potentially execute code with elevated privileges.
 - An overflow condition exists in the 'InputScalesValid()' function in 'browser/themes/browser_theme_pack.cc' that is triggered as certain input is not properly validated when handling browser theme packs. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing to execute arbitrary code.
 - A type confusion flaw exists in the 'AXARIAGrid::AddRow()' function in 'modules/accessibility/AXARIAGrid.cpp' that is triggered when handling table rows. This may allow a context-dependent attacker to execute arbitrary code.
 - An overflow condition exists in 'core/fxcodec/codec/fx_codec_jpx_opj.cpp' that is triggered as improper allocate and free functions of OpenJPEG are used. This may allow a context-dependent attacker to cause a heap-based buffer overflow, potentially allowing to execute arbitrary code.

This update updates QtWebEngine to the 5.10.1 bugfix and security release. QtWebEngine 5.10.1 is part of the Qt 5.10.1 release, but only the QtWebEngine component is included in this update.

This update includes :

  - Security fixes from Chromium up to version     64.0.3282.140. Including: CVE-2017-15407,     CVE-2017-15409, CVE-2017-15410, CVE-2017-15411,     CVE-2017-15415, CVE-2017-15416, CVE-2017-15418,     CVE-2017-15419, CVE-2017-15422, CVE-2017-15423,     CVE-2017-15424, CVE-2017-15425, CVE-2017-15426,     CVE-2018-6031, CVE-2018-6033, CVE-2018-6034,     CVE-2018-6036, CVE-2018-6037, CVE-2018-6038,     CVE-2018-6040, CVE-2018-6041, CVE-2018-6042,     CVE-2018-6047, CVE-2018-6048, CVE-2018-6050,     CVE-2018-6051, CVE-2018-6052, CVE-2018-6053 and     CVE-2018-6054.

  - Mitigations for SPECTRE: disabled shared-buffers, added     cryptographic noise to precision timers

  - [QTBUG-47206] Fixed incorrect layouting due to bug in     HTML5 viewport support.

  - [QTBUG-47945, QTBUG-65647] Fixed random crashes on exit

  - [QTBUG-57206] Fixed regression in viewport handling in     embedded mode

  - [QTBUG-58400] Improved memory usage when printing

  - [QTBUG-63867] Fixed <canvas> elements when compiled     without OpenGL

  - [QTBUG-63266, QTBUG-64436] Fixed that pointerType of     Pointer Events was empty

  - [QTBUG-63606] Improved runtime disabling and clearing of     HTTP cache

  - [QTBUG-64436] QtWebEngineWidgets: Fixed crash when     exiting fullscreen mode using the context menu.

  - [QTBUG-64560] Fixed rendering glitches after     renderProcessTerminated signal was emitted.

  - [QTBUG-64812] Fixed message bubble position in Hi-DPI     mode

  - [QTBUG-64869, QTBUG-65004] Added testing for 32-bit host     compiler when crossbuilding to 32-bit platforms

  - [QTBUG-64933] QtWebEngineWidgets: Fixed tooltips that     did still show after mouse was moved away.

  - [QTBUG-65239] Fixed hanging of process if application is     closed too fast after startup.

  - [QTBUG-65715] Fixed double margins when printing

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Google Chrome Releases reports :

37 security fixes in this release, including :

- [778505] Critical CVE-2017-15407: Out of bounds write in QUIC.
Reported by Ned Williamson on 2017-10-26

- [762374] High CVE-2017-15408: Heap buffer overflow in PDFium.
Reported by Ke Liu of Tencent's Xuanwu LAB on 2017-09-06

- [763972] High CVE-2017-15409: Out of bounds write in Skia. Reported by Anonymous on 2017-09-11

- [765921] High CVE-2017-15410: Use after free in PDFium. Reported by Luat Nguyen of KeenLab, Tencent on 2017-09-16

- [770148] High CVE-2017-15411: Use after free in PDFium. Reported by Luat Nguyen of KeenLab, Tencent on 2017-09-29

- [727039] High CVE-2017-15412: Use after free in libXML. Reported by Nick Wellnhofer on 2017-05-27

- [766666] High CVE-2017-15413: Type confusion in WebAssembly.
Reported by Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-09-19

- [765512] Medium CVE-2017-15415: Pointer information disclosure in IPC call. Reported by Viktor Brange of Microsoft Offensive Security Research Team on 2017-09-15

- [779314] Medium CVE-2017-15416: Out of bounds read in Blink.
Reported by Ned Williamson on 2017-10-28

- [699028] Medium CVE-2017-15417: Cross origin information disclosure in Skia. Reported by Max May on 2017-03-07

- [765858] Medium CVE-2017-15418: Use of uninitialized value in Skia.
Reported by Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-09-15

- [780312] Medium CVE-2017-15419: Cross origin leak of redirect URL in Blink. Reported by Jun Kokatsu on 2017-10-31

- [777419] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-23

- [774382] Medium CVE-2017-15422: Integer overflow in ICU. Reported by Yuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13

- [780484] Medium CVE-2017-15430: Unsafe navigation in Chromecast Plugin. Reported by jinmo123 on 2017-01-11

- [778101] Low CVE-2017-15423: Issue with SPAKE implementation in BoringSSL. Reported by Greg Hudson on 2017-10-25

- [756226] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by Khalil Zhani on 2017-08-16

- [756456] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by xisigr of Tencent's Xuanwu Lab on 2017-08-17

- [757735] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-08-18

- [768910] Low CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox. Reported by Junaid Farhan on 2017-09-26

- [792099] Various fixes from internal audits, fuzzing and other initiatives

Security fix for CVE-2017-15412 CVE-2017-15422 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15423 CVE-2017-15424 CVE-2017-15425 CVE-2017-15426 CVE-2017-15427 CVE-2017-15429

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201801-03 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, bypass       content security controls, or conduct URL spoofing.
  Workaround :

    There are no known workarounds at this time.

Security fix for CVE-2017-15412 CVE-2017-15422 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15423 CVE-2017-15424 CVE-2017-15425 CVE-2017-15426 CVE-2017-15427 CVE-2017-15429

----

Security fix for CVE-2017-15398, CVE-2017-15399

----

Security fix for CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393 CVE-2017-15394 CVE-2017-15395 CVE-2017-5124 CVE-2017-5125 CVE-2017-5126 CVE-2017-5127.

Build switched to use gtk3.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2017-15407     Ned Williamson discovered an out-of-bounds write issue.

  - CVE-2017-15408     Ke Liu discovered a heap overflow issue in the pdfium     library.

  - CVE-2017-15409     An out-of-bounds write issue was discovered in the skia     library.

  - CVE-2017-15410     Luat Nguyen discovered a use-after-free issue in the     pdfium library.

  - CVE-2017-15411     Luat Nguyen discovered a use-after-free issue in the     pdfium library.

  - CVE-2017-15413     Gaurav Dewan discovered a type confusion issue.

  - CVE-2017-15415     Viktor Brange discovered an information disclosure     issue.

  - CVE-2017-15416     Ned Williamson discovered an out-of-bounds read issue.

  - CVE-2017-15417     Max May discovered an information disclosure issue in     the skia library.

  - CVE-2017-15418     Kushal Arvind Shah discovered an uninitialized value in     the skia library.

  - CVE-2017-15419     Jun Kokatsu discoved an information disclosure issue.

  - CVE-2017-15420     WenXu Wu discovered a URL spoofing issue.

  - CVE-2017-15423     Greg Hudson discovered an issue in the boringssl     library.

  - CVE-2017-15424     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2017-15425     xisigr discovered a URL spoofing issue.

  - CVE-2017-15426     WenXu Wu discovered a URL spoofing issue.

  - CVE-2017-15427     Junaid Farhan discovered an issue with the omnibox.

The version of Google Chrome installed on the remote macOS or Mac OS X host is prior to 63.0.3239.84. It is, therefore, affected by multiple vulnerabilities as noted in Chrome stable channel update release notes for Wednesday, December 6, 2017. Please refer to the release notes for additional information.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 63.0.3239.84. It is, therefore, affected by multiple vulnerabilities as noted in Chrome stable channel update release notes for Wednesday, December 6, 2017. Please refer to the release notes for additional information.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2017:3401 advisory.

  - chromium-browser: out of bounds write in quic (CVE-2017-15407)

  - chromium-browser: heap buffer overflow in pdfium (CVE-2017-15408)

  - chromium-browser: out of bounds write in skia (CVE-2017-15409)

  - chromium-browser: use after free in pdfium (CVE-2017-15410, CVE-2017-15411)

  - libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c (CVE-2017-15412)

  - chromium-browser: type confusion in webassembly (CVE-2017-15413)

  - chromium-browser: pointer information disclosure in ipc call (CVE-2017-15415)

  - chromium-browser: out of bounds read in blink (CVE-2017-15416)

  - chromium-browser: cross origin information disclosure in skia (CVE-2017-15417)

  - chromium-browser: use of uninitialized value in skia (CVE-2017-15418)

  - chromium-browser: cross origin leak of redirect url in blink (CVE-2017-15419)

  - chromium-browser: url spoofing in omnibox (CVE-2017-15420)

  - chromium-browser: integer overflow in icu (CVE-2017-15422)

  - chromium-browser: issue with spake implementation in boringssl (CVE-2017-15423)

  - chromium-browser: url spoof in omnibox (CVE-2017-15424, CVE-2017-15425, CVE-2017-15426)

  - chromium-browser: insufficient blocking of javascript in omnibox (CVE-2017-15427)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
120695	Fedora 28 : chromium (2018-aafdbb5554)	Nessus	Fedora Local Security Checks	high
700351	Google Chrome < 63.0.3239.84 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
108679	Fedora 27 : chromium (2018-faff5f661e)	Nessus	Fedora Local Security Checks	high
107035	Fedora 26 : qt5-qtwebengine (2018-c0d3db441f)	Nessus	Fedora Local Security Checks	high
106991	Fedora 27 : qt5-qtwebengine (2018-e08d828ed9)	Nessus	Fedora Local Security Checks	high
106236	FreeBSD : chromium -- multiple vulnerabilities (1d951e85-ffdb-11e7-8b91-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	high
105968	Fedora 27 : chromium (2017-c2645aa935)	Nessus	Fedora Local Security Checks	high
105629	GLSA-201801-03 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
105501	Fedora 26 : chromium (2017-ea44f172e3)	Nessus	Fedora Local Security Checks	critical
105195	Debian DSA-4064-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
105153	Google Chrome < 63.0.3239.84 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	high
105152	Google Chrome < 63.0.3239.84 Multiple Vulnerabilities	Nessus	Windows	high
105091	RHEL 6 : chromium-browser (RHSA-2017:3401)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2017-15407

high

Tenable Plugins

high

high

high

high

high

high

high

high

critical

high

high

high

high