Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

This update updates QtWebEngine to a snapshot from the Qt 5.6 LTS (long-term support) branch. This is a snapshot of the QtWebEngine that will be included in the bugfix and security release Qt 5.6.3, but only the QtWebEngine component is included in this update.

The update fixes the following security issues in QtWebEngine 5.6.2:
CVE-2016-5133, CVE-2016-5147, CVE-2016-5153, CVE-2016-5155, CVE-2016-5161, CVE-2016-5166, CVE-2016-5170, CVE-2016-5171, CVE-2016-5172, CVE-2016-5181, CVE-2016-5185, CVE-2016-5186, CVE-2016-5187, CVE-2016-5188, CVE-2016-5192, CVE-2016-5198, CVE-2016-5205, CVE-2016-5207, CVE-2016-5208, CVE-2016-5214, CVE-2016-5215, CVE-2016-5221, CVE-2016-5222, CVE-2016-5224, CVE-2016-5225, CVE-2016-9650, CVE-2016-9651, CVE-2016-9652, CVE-2017-5006, CVE-2017-5007, CVE-2017-5008, CVE-2017-5009, CVE-2017-5010, CVE-2017-5012, CVE-2017-5015, CVE-2017-5016, CVE-2017-5017, CVE-2017-5019, CVE-2017-5023, CVE-2017-5024, CVE-2017-5025, CVE-2017-5026, CVE-2017-5027, CVE-2017-5029, CVE-2017-5033, CVE-2017-5037, CVE-2017-5044, CVE-2017-5046, CVE-2017-5047, CVE-2017-5048, CVE-2017-5049, CVE-2017-5050, CVE-2017-5051, CVE-2017-5059, CVE-2017-5061, CVE-2017-5062, CVE-2017-5065, CVE-2017-5067, CVE-2017-5069, CVE-2017-5070, CVE-2017-5071, CVE-2017-5075, CVE-2017-5076, CVE-2016-5078, CVE-2017-5083, and CVE-2017-5089.

Other important changes include :

  - Based on Chromium 49.0.2623.111 (the version used in     QtWebEngine 5.7.x) with security fixes from Chromium up     to version 59.0.3071.104. (5.6.2 was based on Chromium     45.0.2554.101 with security fixes from Chromium up to     version 52.0.2743.116.)

  - All other bug fixes from QtWebEngine 5.7.1 have been     backported.

See http://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/changes-5.6.3?h=5.
6 for details. (Please note that at the time of this writing, not all security backports are listed in that file yet. The list above is accurate.)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update updates QtWebEngine to the 5.9.1 release, a security and bugfix release from the 5.9 branch. QtWebEngine 5.9.1 is part of the Qt 5.9.1 release, but only the QtWebEngine component is included in this update.

The update fixes the following security issues in QtWebEngine 5.9.0:
CVE-2017-5070, CVE-2017-5071, CVE-2017-5075, CVE-2017-5076, CVE-2017-5077, CVE-2017-5078, CVE-2017-5079, CVE-2017-5083, CVE-2017-5088, and CVE-2017-5089 (security fixes from Chromium up to version 59.0.3071.104).

Other notable bugfixes include :

  - [QTBUG-59690] Fixed issue with drops

  - [QTBUG-60588] Fixed error in updating user-agent and     accept-language

  - [QTBUG-61047] Fixed assert in URLRequestContextGetterQt

  - [QTBUG-61186] Fixed cancellation of upload folder     dialogs

  - [QTBUG-57675] Fixed     WebEngineNewViewRequest::requestedUrl when opening     window from JavaScript

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Chromium 59. Add smaller logo files. Fix lots of security bugs:
Security fix for CVE-2017-5070, CVE-2017-5071, CVE-2017-5072, CVE-2017-5073, CVE-2017-5074, CVE-2017-5075, CVE-2017-5086, CVE-2017-5076, CVE-2017-5077, CVE-2017-5078, CVE-2017-5079, CVE-2017-5080, CVE-2017-5081, CVE-2017-5082, CVE-2017-5083, CVE-2017-5085

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201706-20 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, bypass security restrictions or spoof content.
  Workaround :

    There is no known workaround at this time.

The version of Google Chrome installed on the remote macOS or Mac OS X host is prior to 59.0.3071.86. It is, therefore, affected by the following vulnerabilities :

  - A type confusion error exists in the Google V8 component     that allows an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-5070)

  - An out-of-bounds read error exists in the Google V8     component that allows an unauthenticated, remote     attacker to cause a denial of service condition or the     disclosure of sensitive information. (CVE-2017-5071)

  - Multiple unspecified flaws exist in the Omnibox     component that allows an attacker to spoof the address     in the address bar. (CVE-2017-5072, CVE-2017-5076,     CVE-2017-5083, CVE-2017-5086)

  - A use-after-free error exists in the print preview     functionality that allows an unauthenticated, remote     attacker to execute arbitrary code. (CVE-2017-5073)

  - A use-after-free error exists in the Apps Bluetooth     component that allows an unauthenticated, remote     attacker to execute arbitrary code. (CVE-2017-5074)

  - An unspecified flaw exists in the CSP reporting     component that allows an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2017-5075)

  - An overflow condition exists in the Google Skia     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this, by convincing a user to visit a specially crafted     website, to cause a denial of service condition or the     execution of arbitrary code. (CVE-2017-5077)

  - An unspecified flaw exists in the mailto handling     functionality that allows an unauthenticated, remote     attacker to inject arbitrary commands. (CVE-2017-5078)

  - An unspecified flaw exists in Blink that allows an     attacker to spoof components in the user interface.
    (CVE-2017-5079)

  - A use-after-free free error exists in the credit card     autofill functionality that allows an attacker to have     an unspecified impact. (CVE-2017-5080)

  - An unspecified flaw exists that allows an     unauthenticated, remote attacker to bypass extension     verification mechanisms. (CVE-2017-5081)

  - An unspecified flaw exists in the credit card editor     view functionality that allows an unauthenticated,     remote attacker to disclose credit card information.
    (CVE-2017-5082)

  - An unspecified flaw exists in the WebUI pages component     that allows an unauthenticated, remote attacker to     execute arbitrary JavaScript code. (CVE-2017-5085)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 59.0.3071.86. It is, therefore, affected by the following vulnerabilities :

  - A type confusion error exists in the Google V8 component     that allows an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2017-5070)

  - An out-of-bounds read error exists in the Google V8     component that allows an unauthenticated, remote     attacker to cause a denial of service condition or the     disclosure of sensitive information. (CVE-2017-5071)

  - Multiple unspecified flaws exist in the Omnibox     component that allows an attacker to spoof the address     in the address bar. (CVE-2017-5072, CVE-2017-5076,     CVE-2017-5083, CVE-2017-5086)

  - A use-after-free error exists in the print preview     functionality that allows an unauthenticated, remote     attacker to execute arbitrary code. (CVE-2017-5073)

  - A use-after-free error exists in the Apps Bluetooth     component that allows an unauthenticated, remote     attacker to execute arbitrary code. (CVE-2017-5074)

  - An unspecified flaw exists in the CSP reporting     component that allows an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2017-5075)

  - An overflow condition exists in the Google Skia     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this, by convincing a user to visit a specially crafted     website, to cause a denial of service condition or the     execution of arbitrary code. (CVE-2017-5077)

  - An unspecified flaw exists in the mailto handling     functionality that allows an unauthenticated, remote     attacker to inject arbitrary commands. (CVE-2017-5078)

  - An unspecified flaw exists in Blink that allows an     attacker to spoof components in the user interface.
    (CVE-2017-5079)

  - A use-after-free free error exists in the credit card     autofill functionality that allows an attacker to have     an unspecified impact. (CVE-2017-5080)

  - An unspecified flaw exists that allows an     unauthenticated, remote attacker to bypass extension     verification mechanisms. (CVE-2017-5081)

  - An unspecified flaw exists in the credit card editor     view functionality that allows an unauthenticated,     remote attacker to disclose credit card information.
    (CVE-2017-5082)

  - An unspecified flaw exists in the WebUI pages component     that allows an unauthenticated, remote attacker to     execute arbitrary JavaScript code. (CVE-2017-5085)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update to Chromium 59.0.3071.86 fixes the following security issues :

  - CVE-2017-5070: Type confusion in V8

  - CVE-2017-5071: Out of bounds read in V8

  - CVE-2017-5072: Address spoofing in Omnibox

  - CVE-2017-5073: Use after free in print preview

  - CVE-2017-5074: Use after free in Apps Bluetooth

  - CVE-2017-5075: Information leak in CSP reporting

  - CVE-2017-5086: Address spoofing in Omnibox

  - CVE-2017-5076: Address spoofing in Omnibox

  - CVE-2017-5077: Heap buffer overflow in Skia

  - CVE-2017-5078: Possible command injection in mailto     handling

  - CVE-2017-5079: UI spoofing in Blink

  - CVE-2017-5080: Use after free in credit card autofill

  - CVE-2017-5081: Extension verification bypass

  - CVE-2017-5082: Insufficient hardening in credit card     editor

  - CVE-2017-5083: UI spoofing in Blink

  - CVE-2017-5085: Inappropriate JavaScript execution on     WebUI pages

The version of Google Chrome installed on the remote host is prior to 59.0.3071.86, and is affected by multiple vulnerabilities :

 - An unspecified type confusion flaw exists that may allow a context-dependent attacker to potentially execute arbitrary code. No further details have been provided.
 - An out-of-bounds read flaw. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents.
 - An unspecified flaw exists in Omnibox that may allow a context-dependent attacker to spoof the address. No further details have been provided.
 - A use-after-free error exists in print preview that may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. 
 - An unspecified flaw exists in CSP reporting that may allow a context-dependent attacker to disclose potentially sensitive information. No further details have been provided.
 - An unspecified flaw exists in Omnibox that may allow a context-dependent attacker to spoof the address. No further details have been provided. 
 - An overflow condition exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - An unspecified flaw exists in its mailto handling functionality. This may allow a context-dependent attacker to potentially inject arbitrary commands.
 - An unspecified flaw exists in Blink that may allow a context-dependent attacker to spoof the UI. No further details have been provided.
 - A use-after-free error exists in credit card autofill that may allow a context-dependent attacker to dereference already freed memory and have an unspecified impact.
 - An unspecified flaw exists that may allow a context-dependent attacker to bypass extension verification mechanisms. No further details have been provided.
 - An unspecified flaw exists in the credit card editor view related to insufficient hardening, which may allow a context-dependent attacker to potentially more easily disclose information related to credit cards.
 - An unspecified flaw exists in Blink which may allow a context-dependent attacker to spoof the UI. No further details have been provided.
 - A flaw exists on WebUI pages that is triggered as they improperly allow the execution of JavaScript. This may potentially allow a context-dependent attacker to execute JavaScript code.
 - An unspecified flaw exists that may allow a context-dependent attacker to have an unspecified impact. No further details have been provided.

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 59.0.3071.86.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2017-5070, CVE-2017-5071, CVE-2017-5072, CVE-2017-5073, CVE-2017-5074, CVE-2017-5075, CVE-2017-5076, CVE-2017-5077, CVE-2017-5078, CVE-2017-5079, CVE-2017-5080, CVE-2017-5081, CVE-2017-5086, CVE-2017-5082, CVE-2017-5083, CVE-2017-5085)

Google Chrome releases reports :

30 security fixes in this release

Please reference CVE/URL list for details

ID	Name	Product	Family	Severity
101920	Fedora 24 : qt5-qtwebengine (2017-98bed96d12)	Nessus	Fedora Local Security Checks	critical
101779	Fedora 25 : qt5-qtwebengine (2017-a7a488d8d0)	Nessus	Fedora Local Security Checks	high
101715	Fedora 26 : 1:chromium-native_client (2017-c11d7ef69a)	Nessus	Fedora Local Security Checks	high
101583	Fedora 26 : qt5-qtwebengine (2017-1e34da27f3)	Nessus	Fedora Local Security Checks	high
101510	Fedora 24 : 1:chromium-native_client (2017-b8d76bef4e)	Nessus	Fedora Local Security Checks	high
101124	Fedora 25 : 1:chromium-native_client (2017-a66e2c5b62)	Nessus	Fedora Local Security Checks	high
100946	GLSA-201706-20 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
100680	Google Chrome < 59.0.3071.86 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	high
100679	Google Chrome < 59.0.3071.86 Multiple Vulnerabilities	Nessus	Windows	high
100676	openSUSE Security Update : chromium (openSUSE-2017-661)	Nessus	SuSE Local Security Checks	high
700131	Google Chrome < 59.0.3071.86 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
100660	RHEL 6 : chromium-browser (RHSA-2017:1399)	Nessus	Red Hat Local Security Checks	high
100646	FreeBSD : chromium -- multiple vulnerabilities (52f4b48b-4ac3-11e7-99aa-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-5070

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high