A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.

This update updates QtWebEngine to the 5.9.0 release. QtWebEngine 5.9.0 is part of the Qt 5.9.0 release, but only the QtWebEngine component is included in this update.

The update fixes the following security issues in QtWebEngine 5.8.0:
CVE-2017-5006, CVE-2017-5007, CVE-2017-5008, CVE-2017-5009, CVE-2017-5010, CVE-2017-5011, CVE-2017-5012, CVE-2017-5013, CVE-2017-5014, CVE-2017-5015, CVE-2017-5016, CVE-2017-5017, CVE-2017-5018, CVE-2017-5019, CVE-2017-5020, CVE-2017-5021, CVE-2017-5022, CVE-2017-5023, CVE-2017-5024, CVE-2017-5025, CVE-2017-5026, CVE-2017-5027, CVE-2017-5029, CVE-2017-5032, CVE-2017-5033, CVE-2017-5034, CVE-2017-5036, CVE-2017-5039, CVE-2017-5040, CVE-2017-5044, CVE-2017-5045, CVE-2017-5046, CVE-2017-5052, CVE-2017-5053, CVE-2017-5055, CVE-2017-5057, CVE-2017-5058, CVE-2017-5059, CVE-2017-5060, CVE-2017-5061, CVE-2017-5062, CVE-2017-5065, CVE-2017-5066, CVE-2017-5067, CVE-2017-5068, and CVE-2017-5069.

Other important changes include :

  - Based on Chromium 56.0.2924.122 with security fixes from     Chromium up to version 58.0.3029.96. (5.8.0 was based on     Chromium 53.0.2785.148 with security fixes from Chromium     up to version 55.0.2883.75.)

  - [QTBUG-54650, QTBUG-59922] Accessibility is now disabled     by default on Linux, like it is in Chrome, due to poor     options for enabling it conditionally and its heavy     performance impact. Set the environment variable     `QTWEBENGINE_ENABLE_LINUX_ACCESSIBILITY` to enable it     again.

  - [QTBUG-56531] Enabled `filesystem:` protocol handler.

  - [QTBUG-57720] Optimized incremental scene-graph     rendering in particular for software rendering.

  - [QTBUG-60049] Enabled brotli support.

  - Many bug fixes, see     https://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/cha     nges-5.9.0?h=5.9 for details.

In addition, this build includes a fix for https://bugreports.qt.io/browse/QTBUG-61521 , a binary incompatibility in QtWebEngine 5.9.0 compared to 5.8.0.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201704-02 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

Chromium was updated to 57.0.2987.98 to fix security issues and bugs.

The following vulnerabilities were fixed (bsc#1028848) :

  - CVE-2017-5030: Memory corruption in V8

  - CVE-2017-5031: Use after free in ANGLE

  - CVE-2017-5032: Out of bounds write in PDFium

  - CVE-2017-5029: Integer overflow in libxslt

  - CVE-2017-5034: Use after free in PDFium

  - CVE-2017-5035: Incorrect security UI in Omnibox

  - CVE-2017-5036: Use after free in PDFium

  - CVE-2017-5037: Multiple out of bounds writes in     ChunkDemuxer

  - CVE-2017-5039: Use after free in PDFium

  - CVE-2017-5040: Information disclosure in V8

  - CVE-2017-5041: Address spoofing in Omnibox

  - CVE-2017-5033: Bypass of Content Security Policy in     Blink

  - CVE-2017-5042: Incorrect handling of cookies in Cast

  - CVE-2017-5038: Use after free in GuestView

  - CVE-2017-5043: Use after free in GuestView

  - CVE-2017-5044: Heap overflow in Skia

  - CVE-2017-5045: Information disclosure in XSS Auditor

  - CVE-2017-5046: Information disclosure in Blink

The following non-security changes are included :

  - Address broken rendering on non-intel cards

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2017-5029     Holger Fuhrmannek discovered an integer overflow issue     in the libxslt library.

  - CVE-2017-5030     Brendon Tiszka discovered a memory corruption issue in     the v8 JavaScript library.

  - CVE-2017-5031     Looben Yang discovered a use-after-free issue in the     ANGLE library.

  - CVE-2017-5032     Ashfaq Ansari discovered an out-of-bounds write in the     pdfium library.

  - CVE-2017-5033     Nicolai Grodum discovered a way to bypass the Content     Security Policy.

  - CVE-2017-5034     Ke Liu discovered an integer overflow issue in the     pdfium library.

  - CVE-2017-5035     Enzo Aguado discovered an issue with the omnibox.

  - CVE-2017-5036     A use-after-free issue was discovered in the pdfium     library.

  - CVE-2017-5037     Yongke Wang discovered multiple out-of-bounds write     issues.

  - CVE-2017-5038     A use-after-free issue was discovered in the guest view.

  - CVE-2017-5039     jinmo123 discovered a use-after-free issue in the pdfium     library.

  - CVE-2017-5040     Choongwoo Han discovered an information disclosure issue     in the v8 JavaScript library.

  - CVE-2017-5041     Jordi Chancel discovered an address spoofing issue.

  - CVE-2017-5042     Mike Ruddy discovered incorrect handling of cookies.

  - CVE-2017-5043     Another use-after-free issue was discovered in the guest     view.

  - CVE-2017-5044     Kushal Arvind Shah discovered a heap overflow issue in     the skia library.

  - CVE-2017-5045     Dhaval Kapil discovered an information disclosure issue.

  - CVE-2017-5046     Masato Kinugawa discovered an information disclosure     issue.

The version of Google Chrome installed on the remote macOS or Mac OS X host is prior to 57.0.2987.98. It is, therefore, affected by the following vulnerabilities :

  - An integer overflow condition condition exists in     libxslt in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write error, resulting in     the execution of arbitrary code. (CVE-2017-5029)

  - A flaw exists in Google V8 in the ArrayConcatVisitor     class in builtins-array.cc due to improper handling of     JSProxy species. An unauthenticated, remote attacker can     exploit this to corrupt memory, resulting in a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-5030)

  - A use-after-free error exists in the ANGLE component due     to improper handling of buffer storage operations. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5031)

  - An overflow condition exists in Google PDFium in the     GetTextRunInfo() function in pdfium_page.cc that is     triggered when processing text runs. An unauthenticated,     remote attacker can exploit this, via a specially     crafted PDF file, to execute arbitrary code.
    (CVE-2017-5032)

  - A security bypass vulnerability exists in the     initContentSecurityPolicy() function in Document.cpp due     to local schemes not inheriting the content security     policy. An unauthenticated, remote attacker can exploit     this to bypass the content security policy.
    (CVE-2017-5033)

  - A flaw exists in the OpenJPEG component in the     m_mct_records() function in j2k.c due to improper     handling of specially crafted JPEG2000 files. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2017-5034)

  - An unspecified flaw exists in the     RendererDidNavigateToExistingPage() function in     navigation_controller_impl.cc that occurs when handling     data from the renderer process. An unauthenticated,     remote attacker can exploit this to have an unspecified     impact on the security UI. (CVE-2017-5035)

  - A use-after-free error exists in Google PDFium in the     Document class in Document.h due to improper handling of     'm_Icons' properties. An unauthenticated, remote     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2017-5036)

  - Multiple integer overflow conditions exists in the     TrackFragmentRun::Parse() function in box_definitions.cc     due to improper parsing of track fragments in MP4     content. An unauthenticated, remote attacker can exploit     this to execute arbitrary code. (CVE-2017-5037)

  - An unspecified use-after-free error occurs when     GuestView objects inherit the prototypes from the global     JS object. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2017-5038)

  - A use-after-free error exists in Google PDFium in the     GlobalTimer() function in app.cpp due to improper     handling of timers. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2017-5039)

  - An unspecified flaw exists in Google V8 that allows an     unauthenticated, remote attacker to disclose sensitive     information. (CVE-2017-5040)

  - A flaw exists in the Omnibox address bar that allows an     unauthenticated, remote attacker to spoof an address.
    (CVE-2017-5041)

  - An unspecified flaw exists in the Cast feature that is     triggered when handling cookies. An unauthenticated,     remote attacker can exploit this to have an unspecified     impact. (CVE-2017-5042)

  - A use-after-free error exists in     guest_view_internal_custom_bindings.cc due to improper     handling of the GuestViewContainer pointer during a     GuestView attach operation. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.
    (CVE-2017-5043)

  - A heap-based overflow condition exists in Google Skia     that occurs when deserializing SkRegion objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5044)

  - An unspecified flaw exists in the XSS auditor that     allows an unauthenticated, remote attacker to disclose     sensitive information. (CVE-2017-5045)

  - An unspecified flaw exists in interface_base.cpp.tmpl     that occurs when handling author scripts interacting     with Symbol.toPrimitive properties of Location objects.
    An unauthenticated, remote attacker can exploit this to     disclose sensitive information. (CVE-2017-5046)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 57.0.2987.98. It is, therefore, affected by the following vulnerabilities :

  - An integer overflow condition condition exists in     libxslt in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write error, resulting in     the execution of arbitrary code. (CVE-2017-5029)

  - A flaw exists in Google V8 in the ArrayConcatVisitor     class in builtins-array.cc due to improper handling of     JSProxy species. An unauthenticated, remote attacker can     exploit this to corrupt memory, resulting in a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-5030)

  - A use-after-free error exists in the ANGLE component due     to improper handling of buffer storage operations. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5031)

  - An overflow condition exists in Google PDFium in the     GetTextRunInfo() function in pdfium_page.cc that is     triggered when processing text runs. An unauthenticated,     remote attacker can exploit this, via a specially     crafted PDF file, to execute arbitrary code.
    (CVE-2017-5032)

  - A security bypass vulnerability exists in the     initContentSecurityPolicy() function in Document.cpp due     to local schemes not inheriting the content security     policy. An unauthenticated, remote attacker can exploit     this to bypass the content security policy.
    (CVE-2017-5033)

  - A flaw exists in the OpenJPEG component in the     m_mct_records() function in j2k.c due to improper     handling of specially crafted JPEG2000 files. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2017-5034)

  - An unspecified flaw exists in the     RendererDidNavigateToExistingPage() function in     navigation_controller_impl.cc that occurs when handling     data from the renderer process. An unauthenticated,     remote attacker can exploit this to have an unspecified     impact on the security UI. (CVE-2017-5035)

  - A use-after-free error exists in Google PDFium in the     Document class in Document.h due to improper handling of     'm_Icons' properties. An unauthenticated, remote     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2017-5036)

  - Multiple integer overflow conditions exists in the     TrackFragmentRun::Parse() function in box_definitions.cc     due to improper parsing of track fragments in MP4     content. An unauthenticated, remote attacker can exploit     this to execute arbitrary code. (CVE-2017-5037)

  - An unspecified use-after-free error occurs when     GuestView objects inherit the prototypes from the global     JS object. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2017-5038)

  - A use-after-free error exists in Google PDFium in the     GlobalTimer() function in app.cpp due to improper     handling of timers. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2017-5039)

  - An unspecified flaw exists in Google V8 that allows an     unauthenticated, remote attacker to disclose sensitive     information. (CVE-2017-5040)

  - A flaw exists in the Omnibox address bar that allows an     unauthenticated, remote attacker to spoof an address.
    (CVE-2017-5041)

  - An unspecified flaw exists in the Cast feature that is     triggered when handling cookies. An unauthenticated,     remote attacker can exploit this to have an unspecified     impact. (CVE-2017-5042)

  - A use-after-free error exists in     guest_view_internal_custom_bindings.cc due to improper     handling of the GuestViewContainer pointer during a     GuestView attach operation. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.
    (CVE-2017-5043)

  - A heap-based overflow condition exists in Google Skia     that occurs when deserializing SkRegion objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5044)

  - An unspecified flaw exists in the XSS auditor that     allows an unauthenticated, remote attacker to disclose     sensitive information. (CVE-2017-5045)

  - An unspecified flaw exists in interface_base.cpp.tmpl     that occurs when handling author scripts interacting     with Symbol.toPrimitive properties of Location objects.
    An unauthenticated, remote attacker can exploit this to     disclose sensitive information. (CVE-2017-5046)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 57.0.2987.98.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2017-5029, CVE-2017-5030, CVE-2017-5031, CVE-2017-5032, CVE-2017-5034, CVE-2017-5035, CVE-2017-5036, CVE-2017-5037, CVE-2017-5039, CVE-2017-5033, CVE-2017-5038, CVE-2017-5040, CVE-2017-5041, CVE-2017-5042, CVE-2017-5043, CVE-2017-5044, CVE-2017-5045, CVE-2017-5046)

Google Chrome Releases reports :

36 security fixes in this release

Please reference CVE/URL list for details

ID	Name	Product	Family	Severity
101740	Fedora 26 : qt5-qtwebengine (2017-e83c26a8c9)	Nessus	Fedora Local Security Checks	critical
101504	Fedora 25 : qt5-qtwebengine (2017-58cde32413)	Nessus	Fedora Local Security Checks	critical
99275	GLSA-201704-02 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
97817	openSUSE Security Update : Chromium (openSUSE-2017-353)	Nessus	SuSE Local Security Checks	high
97783	Debian DSA-3810-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
97725	Google Chrome < 57.0.2987.98 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	high
97724	Google Chrome < 57.0.2987.98 Multiple Vulnerabilities	Nessus	Windows	high
97718	RHEL 6 : chromium-browser (RHSA-2017:0499)	Nessus	Red Hat Local Security Checks	high
97689	FreeBSD : chromium -- multiple vulnerabilities (a505d397-0758-11e7-8d8b-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-5034

high

Tenable Plugins

critical

critical

critical

high

high

high

high

high

high