Use after free in WebUI in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension.

Google Chrome Releases reports :

Several security fixes in this release, including :

- [780450] High CVE-2018-6031: Use after free in PDFium. Reported by Anonymous on 2017-11-01

- [787103] High CVE-2018-6032: Same origin bypass in Shared Worker.
Reported by Jun Kokatsu (@shhnjk) on 2017-11-20

- [793620] High CVE-2018-6033: Race when opening downloaded files.
Reported by Juho Nurminen on 2017-12-09

- [784183] Medium CVE-2018-6034: Integer overflow in Blink. Reported by Tobias Klein (www.trapkit.de) on 2017-11-12

- [797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23

- [797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23

- [753645] Medium CVE-2018-6037: Insufficient user gesture requirements in autofill. Reported by Paul Stone of Context Information Security on 2017-08-09

- [774174] Medium CVE-2018-6038: Heap buffer overflow in WebGL.
Reported by cloudfuzzer on 2017-10-12

- [775527] Medium CVE-2018-6039: XSS in DevTools. Reported by Juho Nurminen on 2017-10-17

- [778658] Medium CVE-2018-6040: Content security policy bypass.
Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-26

- [760342] Medium CVE-2018-6041: URL spoof in Navigation. Reported by Luan Herrera on 2017-08-29

- [773930] Medium CVE-2018-6042: URL spoof in OmniBox. Reported by Khalil Zhani on 2017-10-12

- [785809] Medium CVE-2018-6043: Insufficient escaping with external URL handlers. Reported by 0x09AL on 2017-11-16

- [797497] Medium CVE-2018-6045: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23

- [798163] Medium CVE-2018-6046: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-31

- [799847] Medium CVE-2018-6047: Cross origin URL leak in WebGL.
Reported by Masato Kinugawa on 2018-01-08

- [763194] Low CVE-2018-6048: Referrer policy bypass in Blink.
Reported by Jun Kokatsu (@shhnjk) on 2017-09-08

- [771848] Low CVE-2017-15420: URL spoofing in Omnibox. Reported by Drew Springall (@_aaspring_) on 2017-10-05

- [774438] Low CVE-2018-6049: UI spoof in Permissions. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-13

- [774842] Low CVE-2018-6050: URL spoof in OmniBox. Reported by Jonathan Kew on 2017-10-15

- [441275] Low CVE-2018-6051: Referrer leak in XSS Auditor. Reported by Antonio Sanso (@asanso) on 2014-12-11

- [615608] Low CVE-2018-6052: Incomplete no-referrer policy implementation. Reported by Tanner Emek on 2016-05-28

- [758169] Low CVE-2018-6053: Leak of page thumbnails in New Tab Page.
Reported by Asset Kabdenov on 2017-08-23

- [797511] Low CVE-2018-6054: Use after free in WebUI. Reported by Rob Wu on 2017-12-24

This update updates QtWebEngine to the 5.10.1 bugfix and security release. QtWebEngine 5.10.1 is part of the Qt 5.10.1 release, but only the QtWebEngine component is included in this update.

This update includes :

  - Security fixes from Chromium up to version     64.0.3282.140. Including: CVE-2017-15407,     CVE-2017-15409, CVE-2017-15410, CVE-2017-15411,     CVE-2017-15415, CVE-2017-15416, CVE-2017-15418,     CVE-2017-15419, CVE-2017-15422, CVE-2017-15423,     CVE-2017-15424, CVE-2017-15425, CVE-2017-15426,     CVE-2018-6031, CVE-2018-6033, CVE-2018-6034,     CVE-2018-6036, CVE-2018-6037, CVE-2018-6038,     CVE-2018-6040, CVE-2018-6041, CVE-2018-6042,     CVE-2018-6047, CVE-2018-6048, CVE-2018-6050,     CVE-2018-6051, CVE-2018-6052, CVE-2018-6053 and     CVE-2018-6054.

  - Mitigations for SPECTRE: disabled shared-buffers, added     cryptographic noise to precision timers

  - [QTBUG-47206] Fixed incorrect layouting due to bug in     HTML5 viewport support.

  - [QTBUG-47945, QTBUG-65647] Fixed random crashes on exit

  - [QTBUG-57206] Fixed regression in viewport handling in     embedded mode

  - [QTBUG-58400] Improved memory usage when printing

  - [QTBUG-63867] Fixed <canvas> elements when compiled     without OpenGL

  - [QTBUG-63266, QTBUG-64436] Fixed that pointerType of     Pointer Events was empty

  - [QTBUG-63606] Improved runtime disabling and clearing of     HTTP cache

  - [QTBUG-64436] QtWebEngineWidgets: Fixed crash when     exiting fullscreen mode using the context menu.

  - [QTBUG-64560] Fixed rendering glitches after     renderProcessTerminated signal was emitted.

  - [QTBUG-64812] Fixed message bubble position in Hi-DPI     mode

  - [QTBUG-64869, QTBUG-65004] Added testing for 32-bit host     compiler when crossbuilding to 32-bit platforms

  - [QTBUG-64933] QtWebEngineWidgets: Fixed tooltips that     did still show after mouse was moved away.

  - [QTBUG-65239] Fixed hanging of process if application is     closed too fast after startup.

  - [QTBUG-65715] Fixed double margins when printing

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201802-02 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the referenced CVE identifiers and Google Chrome       Releases for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, bypass       content security controls, or conduct URL spoofing.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:0265 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 64.0.3282.119.

    Security Fix(es):

    * Multiple flaws were found in the processing of malformed web content. A web page containing malicious     content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when     visited by the victim. (CVE-2018-6031, CVE-2018-6032, CVE-2018-6033, CVE-2018-6034, CVE-2018-6035,     CVE-2018-6036, CVE-2018-6037, CVE-2018-6038, CVE-2018-6039, CVE-2018-6040, CVE-2018-6041, CVE-2018-6042,     CVE-2018-6043, CVE-2018-6045, CVE-2018-6046, CVE-2018-6047, CVE-2018-6048, CVE-2018-6049, CVE-2018-6050,     CVE-2018-6051, CVE-2018-6052, CVE-2018-6053, CVE-2018-6054)

    * To mitigate timing-based side-channel attacks similar to Spectre and Meltdown, this update reduces     the precision of the timing data provided by the Date object and the performance.now() API, and the V8     JavaScript engine now uses masking of certain addresses and array or string indices.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2017-15420     Drew Springall discovered a URL spoofing issue.

  - CVE-2017-15429     A cross-site scripting issue was discovered in the v8     JavaScript library.

  - CVE-2018-6031     A use-after-free issue was discovered in the pdfium     library.

  - CVE-2018-6032     Jun Kokatsu discovered a way to bypass the same origin     policy.

  - CVE-2018-6033     Juho Nurminen discovered a race condition when opening     downloaded files.

  - CVE-2018-6034     Tobias Klein discovered an integer overflow issue.

  - CVE-2018-6035     Rob Wu discovered a way for extensions to access     devtools.

  - CVE-2018-6036     UK's National Cyber Security Centre discovered an     integer overflow issue.

  - CVE-2018-6037     Paul Stone discovered an issue in the autofill feature.

  - CVE-2018-6038     cloudfuzzer discovered a buffer overflow issue.

  - CVE-2018-6039     Juho Nurminen discovered a cross-site scripting issue in     the developer tools.

  - CVE-2018-6040     WenXu Wu discovered a way to bypass the content security     policy.

  - CVE-2018-6041     Luan Herrera discovered a URL spoofing issue.

  - CVE-2018-6042     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6043     A character escaping issue was discovered.

  - CVE-2018-6045     Rob Wu discovered a way for extensions to access     devtools.

  - CVE-2018-6046     Rob Wu discovered a way for extensions to access     devtools.

  - CVE-2018-6047     Masato Kinugawa discovered an information leak issue.

  - CVE-2018-6048     Jun Kokatsu discovered a way to bypass the referrer     policy.

  - CVE-2018-6049     WenXu Wu discovered a user interface spoofing issue.

  - CVE-2018-6050     Jonathan Kew discovered a URL spoofing issue.

  - CVE-2018-6051     Antonio Sanso discovered an information leak issue.

  - CVE-2018-6052     Tanner Emek discovered that the referrer policy     implementation was incomplete.

  - CVE-2018-6053     Asset Kabdenov discovered an information leak issue.

  - CVE-2018-6054     Rob Wu discovered a use-after-free issue.

The version of Google Chrome installed on the remote Windows host is prior to 64.0.3282.119. It is, therefore, affected by multiple security vulnerabilities as noted in Chrome stable channel update release notes for January 24th, 2018. Please refer to the release notes for additional information.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

This update for chromium to 64.0.3282.119 fixes several issues.

These security issues were fixed :

  - CVE-2018-6031: Use after free in PDFium (boo#1077571)

  - CVE-2018-6032: Same origin bypass in Shared Worker     (boo#1077571)

  - CVE-2018-6033: Race when opening downloaded files     (boo#1077571)

  - CVE-2018-6034: Integer overflow in Blink (boo#1077571)

  - CVE-2018-6035: Insufficient isolation of devtools from     extensions (boo#1077571)

  - CVE-2018-6036: Integer underflow in WebAssembly     (boo#1077571)

  - CVE-2018-6037: Insufficient user gesture requirements in     autofill (boo#1077571)

  - CVE-2018-6038: Heap buffer overflow in WebGL     (boo#1077571)

  - CVE-2018-6039: XSS in DevTools (boo#1077571)

  - CVE-2018-6040: Content security policy bypass     (boo#1077571)

  - CVE-2018-6041: URL spoof in Navigation (boo#1077571)

  - CVE-2018-6042: URL spoof in OmniBox (boo#1077571)

  - CVE-2018-6043: Insufficient escaping with external URL     handlers (boo#1077571)

  - CVE-2018-6045: Insufficient isolation of devtools from     extensions (boo#1077571)

  - CVE-2018-6046: Insufficient isolation of devtools from     extensions (boo#1077571)

  - CVE-2018-6047: Cross origin URL leak in WebGL     (boo#1077571)

  - CVE-2018-6048: Referrer policy bypass in Blink     (boo#1077571)

  - CVE-2017-15420: URL spoofing in Omnibox (boo#1077571)

  - CVE-2018-6049: UI spoof in Permissions (boo#1077571)

  - CVE-2018-6050: URL spoof in OmniBox (boo#1077571)

  - CVE-2018-6051: Referrer leak in XSS Auditor     (boo#1077571)

  - CVE-2018-6052: Incomplete no-referrer policy     implementation (boo#1077571)

  - CVE-2018-6053: Leak of page thumbnails in New Tab Page     (boo#1077571)

  - CVE-2018-6054: Use after free in WebUI (boo#1077571)

Re was updated to version 2018-01-01 (boo#1073323)

ID	Name	Product	Family	Severity
107044	FreeBSD : chromium -- multiple vulnerabilities (8e986b2b-1baa-11e8-a944-54ee754af08e)	Nessus	FreeBSD Local Security Checks	high
107035	Fedora 26 : qt5-qtwebengine (2018-c0d3db441f)	Nessus	Fedora Local Security Checks	high
106991	Fedora 27 : qt5-qtwebengine (2018-e08d828ed9)	Nessus	Fedora Local Security Checks	high
106883	GLSA-201802-02 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
106574	RHEL 6 : chromium-browser (RHSA-2018:0265)	Nessus	Red Hat Local Security Checks	high
106537	Debian DSA-4103-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
106486	Google Chrome < 64.0.3282.119 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	high
106485	Google Chrome < 64.0.3282.119 Multiple Vulnerabilities (Spectre)	Nessus	Windows	high
106432	openSUSE Security Update : chromium (openSUSE-2018-103)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-6054

high

Tenable Plugins

high

high

high

high

high

high

high

high

high