Insufficient policy enforcement in Catalog Service in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox via a crafted HTML page.

Security fixes for CVE-2018-6055 CVE-2018-6119 CVE-2018-16429 CVE-2018-16428

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fixes for CVE-2018-6055 CVE-2018-6119 CVE-2018-16429 CVE-2018-16428

----

Update to Chromium 69. (EPEL-7 update is blocked by a GCC bug:
1629813, so as soon as devtoolset-8 arrives...)

Fixes a lot of security issues, like every major release of Chromium, including CVE-2018-16087 CVE-2018-16088 CVE-2018-16086CVE-2018-16065 CVE-2018-16066 CVE-2018-16067 CVE-2018-16068 CVE-2018-16069 CVE-2018-16070 CVE-2018-16071 CVE-2018-16072 CVE-2018-16073 CVE-2018-16074 CVE-2018-16075 CVE-2018-16076 CVE-2018-16077 CVE-2018-16078

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:0265 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 64.0.3282.119.

    Security Fix(es):

    * Multiple flaws were found in the processing of malformed web content. A web page containing malicious     content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when     visited by the victim. (CVE-2018-6031, CVE-2018-6032, CVE-2018-6033, CVE-2018-6034, CVE-2018-6035,     CVE-2018-6036, CVE-2018-6037, CVE-2018-6038, CVE-2018-6039, CVE-2018-6040, CVE-2018-6041, CVE-2018-6042,     CVE-2018-6043, CVE-2018-6045, CVE-2018-6046, CVE-2018-6047, CVE-2018-6048, CVE-2018-6049, CVE-2018-6050,     CVE-2018-6051, CVE-2018-6052, CVE-2018-6053, CVE-2018-6054)

    * To mitigate timing-based side-channel attacks similar to Spectre and Meltdown, this update reduces     the precision of the timing data provided by the Date object and the performance.now() API, and the V8     JavaScript engine now uses masking of certain addresses and array or string indices.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
120923	Fedora 28 : chromium (2018-f76e6d17f1)	Nessus	Fedora Local Security Checks	critical
120356	Fedora 29 : chromium (2018-39be36e9fc)	Nessus	Fedora Local Security Checks	critical
106574	RHEL 6 : chromium-browser (RHSA-2018:0265)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2018-6055

high

Tenable Plugins

critical

critical

high