Use after free in WebAudio in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

A QtWebEngine security update backporting security fixes from Chromium 65 (up to 65.0.3325.146). (The backports have been forward-ported from QtWebEngine 5.9.5 LTS.)

This update fixes the following security issues :

  - CVE-2017-15429

  - CVE-2018-6033 (claimed fixed in 5.10.1, but the fix was     incomplete and had no effect; this update adds the     missing part to make the fix effective)

  - CVE-2018-6060

  - CVE-2018-6062

  - CVE-2018-6064

  - CVE-2018-6069

  - CVE-2018-6071

  - CVE-2018-6073

  - CVE-2018-6076

  - CVE-2018-6079

  - CVE-2018-6081

  - CVE-2018-6082

  - Chromium (security) Bug 770734

  - Chromium (security) Bug 774833

  - Chromium (security) Bug 798410

  - Chromium (security) Bug 789764

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Chromium 65. For EPEL7, it has been a long time since a successful build has been possible, so this will fix a LOT of CVEs.

CVE-2017-15396 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15422 CVE-2018-6056 CVE-2018-6406 CVE-2018-6057 CVE-2018-6058 CVE-2018-6059 CVE-2018-6060 CVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065 CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070 CVE-2018-6071

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2018-6056     lokihardt discovered an error in the v8 JavaScript     library.

  - CVE-2018-6057     Gal Beniamini discovered errors related to shared memory     permissions.

  - CVE-2018-6060     Omair discovered a use-after-free issue in blink/webkit.

  - CVE-2018-6061     Guang Gong discovered a race condition in the v8     JavaScript library.

  - CVE-2018-6062     A heap overflow issue was discovered in the v8     JavaScript library.

  - CVE-2018-6063     Gal Beniamini discovered errors related to shared memory     permissions.

  - CVE-2018-6064     lokihardt discovered a type confusion error in the v8     JavaScript library.

  - CVE-2018-6065     Mark Brand discovered an integer overflow issue in the     v8 JavaScript library.

  - CVE-2018-6066     Masato Kinugawa discovered a way to bypass the Same     Origin Policy.

  - CVE-2018-6067     Ned Williamson discovered a buffer overflow issue in the     skia library.

  - CVE-2018-6068     Luan Herrera discovered object lifecycle issues.

  - CVE-2018-6069     Wanglu and Yangkang discovered a stack overflow issue in     the skia library.

  - CVE-2018-6070     Rob Wu discovered a way to bypass the Content Security     Policy.

  - CVE-2018-6071     A heap overflow issue was discovered in the skia     library.

  - CVE-2018-6072     Atte Kettunen discovered an integer overflow issue in     the pdfium library.

  - CVE-2018-6073     Omair discover a heap overflow issue in the WebGL     implementation.

  - CVE-2018-6074     Abdulrahman Alqabandi discovered a way to cause a     downloaded web page to not contain a Mark of the Web.

  - CVE-2018-6075     Inti De Ceukelaire discovered a way to bypass the Same     Origin Policy.

  - CVE-2018-6076     Mateusz Krzeszowiec discovered that URL fragment     identifiers could be handled incorrectly.

  - CVE-2018-6077     Khalil Zhani discovered a timing issue.

  - CVE-2018-6078     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6079     Ivars discovered an information disclosure issue.

  - CVE-2018-6080     Gal Beniamini discovered an information disclosure     issue.

  - CVE-2018-6081     Rob Wu discovered a cross-site scripting issue.

  - CVE-2018-6082     WenXu Wu discovered a way to bypass blocked ports.

  - CVE-2018-6083     Jun Kokatsu discovered that AppManifests could be     handled incorrectly.

  - CVE-2018-6085     Ned Williamson discovered a use-after-free issue.

  - CVE-2018-6086     Ned Williamson discovered a use-after-free issue.

  - CVE-2018-6087     A use-after-free issue was discovered in the WebAssembly     implementation.

  - CVE-2018-6088     A use-after-free issue was discovered in the pdfium     library.

  - CVE-2018-6089     Rob Wu discovered a way to bypass the Same Origin     Policy.

  - CVE-2018-6090     ZhanJia Song discovered a heap overflow issue in the     skia library.

  - CVE-2018-6091     Jun Kokatsu discovered that plugins could be handled     incorrectly.

  - CVE-2018-6092     Natalie Silvanovich discovered an integer overflow issue     in the WebAssembly implementation.

  - CVE-2018-6093     Jun Kokatsu discovered a way to bypass the Same Origin     Policy.

  - CVE-2018-6094     Chris Rohlf discovered a regression in garbage     collection hardening.

  - CVE-2018-6095     Abdulrahman Alqabandi discovered files could be uploaded     without user interaction.

  - CVE-2018-6096     WenXu Wu discovered a user interface spoofing issue.

  - CVE-2018-6097     xisigr discovered a user interface spoofing issue.

  - CVE-2018-6098     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6099     Jun Kokatsu discovered a way to bypass the Cross Origin     Resource Sharing mechanism.

  - CVE-2018-6100     Lnyas Zhang discovered a URL spoofing issue.

  - CVE-2018-6101     Rob Wu discovered an issue in the developer tools remote     debugging protocol.

  - CVE-2018-6102     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6103     Khalil Zhani discovered a user interface spoofing issue.

  - CVE-2018-6104     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6105     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6106     lokihardt discovered that v8 promises could be handled     incorrectly.

  - CVE-2018-6107     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6108     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6109     Dominik Weber discovered a way to misuse the FileAPI     feature.

  - CVE-2018-6110     Wenxiang Qian discovered that local plain text files     could be handled incorrectly.

  - CVE-2018-6111     Khalil Zhani discovered a use-after-free issue in the     developer tools.

  - CVE-2018-6112     Khalil Zhani discovered incorrect handling of URLs in     the developer tools.

  - CVE-2018-6113     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6114     Lnyas Zhang discovered a way to bypass the Content     Security Policy.

  - CVE-2018-6116     Chengdu Security Response Center discovered an error     when memory is low.

  - CVE-2018-6117     Spencer Dailey discovered an error in form autofill     settings.

This update for Chromium to version 65.0.3325.162 fixes the following issues :

  - CVE-2017-11215: Use after free in Flash

  - CVE-2017-11225: Use after free in Flash

  - CVE-2018-6060: Use after free in Blink

  - CVE-2018-6061: Race condition in V8

  - CVE-2018-6062: Heap buffer overflow in Skia

  - CVE-2018-6057: Incorrect permissions on shared memory

  - CVE-2018-6063: Incorrect permissions on shared memory

  - CVE-2018-6064: Type confusion in V8

  - CVE-2018-6065: Integer overflow in V8

  - CVE-2018-6066: Same Origin Bypass via canvas

  - CVE-2018-6067: Buffer overflow in Skia

  - CVE-2018-6068: Object lifecycle issues in Chrome Custom     Tab

  - CVE-2018-6069: Stack-based buffer overflow in Skia

  - CVE-2018-6070: CSP bypass through extensions

  - CVE-2018-6071: Heap bufffer overflow in Skia

  - CVE-2018-6072: Integer overflow in PDFium

  - CVE-2018-6073: Heap bufffer overflow in WebGL

  - CVE-2018-6074: Mark-of-the-Web bypass

  - CVE-2018-6075: Overly permissive cross origin downloads

  - CVE-2018-6076: Incorrect handling of URL fragment     identifiers in Blink

  - CVE-2018-6077: Timing attack using SVG filters

  - CVE-2018-6078: URL Spoof in OmniBox

  - CVE-2018-6079: Information disclosure via texture data     in WebGL

  - CVE-2018-6080: Information disclosure in IPC call

  - CVE-2018-6081: XSS in interstitials

  - CVE-2018-6082: Circumvention of port blocking

  - CVE-2018-6083: Incorrect processing of AppManifests

The remote host is affected by the vulnerability described in GLSA-201803-05 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the referenced CVE identifiers and Google Chrome       Releases for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, bypass       content security controls, or conduct URL spoofing.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:0484 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 65.0.3325.146.

    Security Fix(es):

    * chromium-browser: incorrect permissions on shared memory (CVE-2018-6057)

    * chromium-browser: use-after-free in blink (CVE-2018-6060)

    * chromium-browser: race condition in v8 (CVE-2018-6061)

    * chromium-browser: heap buffer overflow in skia (CVE-2018-6062)

    * chromium-browser: incorrect permissions on shared memory (CVE-2018-6063)

    * chromium-browser: type confusion in v8 (CVE-2018-6064)

    * chromium-browser: integer overflow in v8 (CVE-2018-6065)

    * chromium-browser: same origin bypass via canvas (CVE-2018-6066)

    * chromium-browser: buffer overflow in skia (CVE-2018-6067)

    * chromium-browser: stack buffer overflow in skia (CVE-2018-6069)

    * chromium-browser: csp bypass through extensions (CVE-2018-6070)

    * chromium-browser: heap bufffer overflow in skia (CVE-2018-6071)

    * chromium-browser: integer overflow in pdfium (CVE-2018-6072)

    * chromium-browser: heap bufffer overflow in webgl (CVE-2018-6073)

    * chromium-browser: mark-of-the-web bypass (CVE-2018-6074)

    * chromium-browser: overly permissive cross origin downloads (CVE-2018-6075)

    * chromium-browser: incorrect handling of url fragment identifiers in blink (CVE-2018-6076)

    * chromium-browser: timing attack using svg filters (CVE-2018-6077)

    * chromium-browser: url spoof in omnibox (CVE-2018-6078)

    * chromium-browser: information disclosure via texture data in webgl (CVE-2018-6079)

    * chromium-browser: information disclosure in ipc call (CVE-2018-6080)

    * chromium-browser: xss in interstitials (CVE-2018-6081)

    * chromium-browser: circumvention of port blocking (CVE-2018-6082)

    * chromium-browser: incorrect processing of appmanifests (CVE-2018-6083)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Google Chrome Releases reports :

45 security fixes in this release :

- [758848] High CVE-2017-11215: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25

- [758863] High CVE-2017-11225: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25

- [780919] High CVE-2018-6060: Use after free in Blink. Reported by Omair on 2017-11-02

- [794091] High CVE-2018-6061: Race condition in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2017-12-12

- [780104] High CVE-2018-6062: Heap buffer overflow in Skia. Reported by Anonymous on 2017-10-31

- [789959] High CVE-2018-6057: Incorrect permissions on shared memory.
Reported by Gal Beniamini of Google Project Zero on 2017-11-30

- [792900] High CVE-2018-6063: Incorrect permissions on shared memory.
Reported by Gal Beniamini of Google Project Zero on 2017-12-07

- [798644] High CVE-2018-6064: Type confusion in V8. Reported by lokihardt of Google Project Zero on 2018-01-03

- [808192] High CVE-2018-6065: Integer overflow in V8. Reported by Mark Brand of Google Project Zero on 2018-02-01

- [799477] Medium CVE-2018-6066: Same Origin Bypass via canvas.
Reported by Masato Kinugawa on 2018-01-05

- [779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30

- [779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30

- [799918] Medium CVE-2018-6069: Stack buffer overflow in Skia.
Reported by Wanglu and Yangkang(@dnpushme) of Qihoo360 Qex Team on 2018-01-08

- [668645] Medium CVE-2018-6070: CSP bypass through extensions.
Reported by Rob Wu on 2016-11-25

- [777318] Medium CVE-2018-6071: Heap bufffer overflow in Skia.
Reported by Anonymous on 2017-10-23

- [791048] Medium CVE-2018-6072: Integer overflow in PDFium. Reported by Atte Kettunen of OUSPG on 2017-12-01

- [804118] Medium CVE-2018-6073: Heap bufffer overflow in WebGL.
Reported by Omair on 2018-01-20

- [809759] Medium CVE-2018-6074: Mark-of-the-Web bypass. Reported by Abdulrahman Alqabandi (@qab) on 2018-02-06

- [608669] Medium CVE-2018-6075: Overly permissive cross origin downloads. Reported by Inti De Ceukelaire (intigriti.com) on 2016-05-03

- [758523] Medium CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink. Reported by Mateusz Krzeszowiec on 2017-08-24

- [778506] Medium CVE-2018-6077: Timing attack using SVG filters.
Reported by Khalil Zhani on 2017-10-26

- [793628] Medium CVE-2018-6078: URL Spoof in OmniBox. Reported by Khalil Zhani on 2017-12-10

- [788448] Medium CVE-2018-6079: Information disclosure via texture data in WebGL. Reported by Ivars Atteka on 2017-11-24

- [792028] Medium CVE-2018-6080: Information disclosure in IPC call.
Reported by Gal Beniamini of Google Project Zero on 2017-12-05

- [797525] Low CVE-2018-6081: XSS in interstitials. Reported by Rob Wu on 2017-12-24

- [767354] Low CVE-2018-6082: Circumvention of port blocking. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-09-21

- [771709] Low CVE-2018-6083: Incorrect processing of AppManifests.
Reported by Jun Kokatsu (@shhnjk) on 2017-10-04

The version of Google Chrome installed on the remote host is prior to 65.0.3325.146. It is, therefore, affected by multiple unspecified vulnerabilities as noted in Chrome stable channel update release notes for March 6th, 2018. Please refer to the release notes for additional information.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 65.0.3325.146. It is, therefore, affected by a multiple unspecified vulnerabilities as noted in Chrome stable channel update release notes for March 6th, 2018. Please refer to the release notes for additional information.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
120733	Fedora 28 : qt5-qtwebengine (2018-b844991a97)	Nessus	Fedora Local Security Checks	high
120695	Fedora 28 : chromium (2018-aafdbb5554)	Nessus	Fedora Local Security Checks	high
109411	Debian DSA-4182-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
108679	Fedora 27 : chromium (2018-faff5f661e)	Nessus	Fedora Local Security Checks	high
108616	Fedora 27 : qt5-qtwebengine (2018-44e1c23700)	Nessus	Fedora Local Security Checks	high
108612	Fedora 26 : qt5-qtwebengine (2018-024afa2d48)	Nessus	Fedora Local Security Checks	high
108436	openSUSE Security Update : Chromium (openSUSE-2018-264)	Nessus	SuSE Local Security Checks	critical
108317	GLSA-201803-05 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
108275	RHEL 6 : chromium-browser (RHSA-2018:0484)	Nessus	Red Hat Local Security Checks	high
107243	FreeBSD : chromium -- vulnerability (555af074-22b9-11e8-9799-54ee754af08e)	Nessus	FreeBSD Local Security Checks	critical
107221	Google Chrome < 65.0.3325.146 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	critical
107220	Google Chrome < 65.0.3325.146 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2018-6060

high

Tenable Plugins

high

high

high

high

high

high

critical

high

high

critical

critical

critical