Type confusion could lead to a heap out-of-bounds write in V8 in Google Chrome prior to 64.0.3282.168 allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Update to Chromium 65. For EPEL7, it has been a long time since a successful build has been possible, so this will fix a LOT of CVEs.

CVE-2017-15396 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15422 CVE-2018-6056 CVE-2018-6406 CVE-2018-6057 CVE-2018-6058 CVE-2018-6059 CVE-2018-6060 CVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065 CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070 CVE-2018-6071

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Google Chrome installed on the remote host is prior to 64.0.3282.168, and is affected by a flaw in the 'JSFunction::CalculateInstanceSizeForDerivedClass()' function in 'objects.cc' that is triggered when encountering constructor compilation errors exist during derived class instantiation. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2018-6056     lokihardt discovered an error in the v8 JavaScript     library.

  - CVE-2018-6057     Gal Beniamini discovered errors related to shared memory     permissions.

  - CVE-2018-6060     Omair discovered a use-after-free issue in blink/webkit.

  - CVE-2018-6061     Guang Gong discovered a race condition in the v8     JavaScript library.

  - CVE-2018-6062     A heap overflow issue was discovered in the v8     JavaScript library.

  - CVE-2018-6063     Gal Beniamini discovered errors related to shared memory     permissions.

  - CVE-2018-6064     lokihardt discovered a type confusion error in the v8     JavaScript library.

  - CVE-2018-6065     Mark Brand discovered an integer overflow issue in the     v8 JavaScript library.

  - CVE-2018-6066     Masato Kinugawa discovered a way to bypass the Same     Origin Policy.

  - CVE-2018-6067     Ned Williamson discovered a buffer overflow issue in the     skia library.

  - CVE-2018-6068     Luan Herrera discovered object lifecycle issues.

  - CVE-2018-6069     Wanglu and Yangkang discovered a stack overflow issue in     the skia library.

  - CVE-2018-6070     Rob Wu discovered a way to bypass the Content Security     Policy.

  - CVE-2018-6071     A heap overflow issue was discovered in the skia     library.

  - CVE-2018-6072     Atte Kettunen discovered an integer overflow issue in     the pdfium library.

  - CVE-2018-6073     Omair discover a heap overflow issue in the WebGL     implementation.

  - CVE-2018-6074     Abdulrahman Alqabandi discovered a way to cause a     downloaded web page to not contain a Mark of the Web.

  - CVE-2018-6075     Inti De Ceukelaire discovered a way to bypass the Same     Origin Policy.

  - CVE-2018-6076     Mateusz Krzeszowiec discovered that URL fragment     identifiers could be handled incorrectly.

  - CVE-2018-6077     Khalil Zhani discovered a timing issue.

  - CVE-2018-6078     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6079     Ivars discovered an information disclosure issue.

  - CVE-2018-6080     Gal Beniamini discovered an information disclosure     issue.

  - CVE-2018-6081     Rob Wu discovered a cross-site scripting issue.

  - CVE-2018-6082     WenXu Wu discovered a way to bypass blocked ports.

  - CVE-2018-6083     Jun Kokatsu discovered that AppManifests could be     handled incorrectly.

  - CVE-2018-6085     Ned Williamson discovered a use-after-free issue.

  - CVE-2018-6086     Ned Williamson discovered a use-after-free issue.

  - CVE-2018-6087     A use-after-free issue was discovered in the WebAssembly     implementation.

  - CVE-2018-6088     A use-after-free issue was discovered in the pdfium     library.

  - CVE-2018-6089     Rob Wu discovered a way to bypass the Same Origin     Policy.

  - CVE-2018-6090     ZhanJia Song discovered a heap overflow issue in the     skia library.

  - CVE-2018-6091     Jun Kokatsu discovered that plugins could be handled     incorrectly.

  - CVE-2018-6092     Natalie Silvanovich discovered an integer overflow issue     in the WebAssembly implementation.

  - CVE-2018-6093     Jun Kokatsu discovered a way to bypass the Same Origin     Policy.

  - CVE-2018-6094     Chris Rohlf discovered a regression in garbage     collection hardening.

  - CVE-2018-6095     Abdulrahman Alqabandi discovered files could be uploaded     without user interaction.

  - CVE-2018-6096     WenXu Wu discovered a user interface spoofing issue.

  - CVE-2018-6097     xisigr discovered a user interface spoofing issue.

  - CVE-2018-6098     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6099     Jun Kokatsu discovered a way to bypass the Cross Origin     Resource Sharing mechanism.

  - CVE-2018-6100     Lnyas Zhang discovered a URL spoofing issue.

  - CVE-2018-6101     Rob Wu discovered an issue in the developer tools remote     debugging protocol.

  - CVE-2018-6102     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6103     Khalil Zhani discovered a user interface spoofing issue.

  - CVE-2018-6104     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6105     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6106     lokihardt discovered that v8 promises could be handled     incorrectly.

  - CVE-2018-6107     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6108     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6109     Dominik Weber discovered a way to misuse the FileAPI     feature.

  - CVE-2018-6110     Wenxiang Qian discovered that local plain text files     could be handled incorrectly.

  - CVE-2018-6111     Khalil Zhani discovered a use-after-free issue in the     developer tools.

  - CVE-2018-6112     Khalil Zhani discovered incorrect handling of URLs in     the developer tools.

  - CVE-2018-6113     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6114     Lnyas Zhang discovered a way to bypass the Content     Security Policy.

  - CVE-2018-6116     Chengdu Security Response Center discovered an error     when memory is low.

  - CVE-2018-6117     Spencer Dailey discovered an error in form autofill     settings.

Google Chrome Releases reports :

1 security fix in this release :

- [806388] High CVE-2018-6056: Incorrect derived class instantiation in V8. Reported by lokihardt of Google Project Zero on 2018-01-26

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:0334 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 64.0.3282.167.

    Security Fix(es):

    * chromium-browser: incorrect derived class instantiation in v8 (CVE-2018-6056)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201802-02 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the referenced CVE identifiers and Google Chrome       Releases for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, bypass       content security controls, or conduct URL spoofing.
  Workaround :

    There is no known workaround at this time.

This update for chromium to version 64.0.3282.167 fixes the following issue :

  - CVE-2018-6056: Incorrect derived class instantiation in     V8 (bsc#1080920)

The version of Google Chrome installed on the remote host is prior to 64.0.3282.167. It is, therefore, affected by a flaw in the V8 JavaScript engine as noted in Chrome stable channel update release notes for February 13th, 2018. Please refer to the release notes for additional information.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 64.0.3282.167. It is, therefore, affected by a flaw in the V8 JavaScript engine as noted in Chrome stable channel update release notes for February 13th, 2018. Please refer to the release notes for additional information.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
120695	Fedora 28 : chromium (2018-aafdbb5554)	Nessus	Fedora Local Security Checks	high
700354	Google Chrome < 64.0.3282.168 RCE	Nessus Network Monitor	Web Clients	high
109411	Debian DSA-4182-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
108679	Fedora 27 : chromium (2018-faff5f661e)	Nessus	Fedora Local Security Checks	high
107045	FreeBSD : chromium -- vulnerability (abfc932e-1ba8-11e8-a944-54ee754af08e)	Nessus	FreeBSD Local Security Checks	high
106925	RHEL 6 : chromium-browser (RHSA-2018:0334)	Nessus	Red Hat Local Security Checks	high
106883	GLSA-201802-02 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
106860	openSUSE Security Update : chromium (openSUSE-2018-165)	Nessus	SuSE Local Security Checks	high
106841	Google Chrome < 64.0.3282.167 V8 JSFunction::CalculateInstanceSizeForDerivedClass() RCE (macOS)	Nessus	MacOS X Local Security Checks	high
106840	Google Chrome < 64.0.3282.167 V8 JSFunction::CalculateInstanceSizeForDerivedClass() RCE	Nessus	Windows	high

Detections

Analytics

CVE-2018-6056

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high