An integer overflow that could lead to an attacker-controlled heap out-of-bounds write in PDFium in Google Chrome prior to 66.0.3359.170 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.

Update to 66.0.3359.181. Security fix for CVE-2018-6085 CVE-2018-6086 CVE-2018-6087 CVE-2018-6088 CVE-2018-6089 CVE-2018-6090 CVE-2018-6091 CVE-2018-6092 CVE-2018-6093 CVE-2018-6094 CVE-2018-6095 CVE-2018-6096 CVE-2018-6097 CVE-2018-6098 CVE-2018-6099 CVE-2018-6100 CVE-2018-6101 CVE-2018-6102 CVE-2018-6103 CVE-2018-6104 CVE-2018-6105 CVE-2018-6106 CVE-2018-6107 CVE-2018-6108 CVE-2018-6109 CVE-2018-6110 CVE-2018-6111 CVE-2018-6112 CVE-2018-6113 CVE-2018-6114 CVE-2018-6116 CVE-2018-6117 CVE-2018-6118 CVE-2018-6121 CVE-2018-6122 CVE-2018-6120

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Google Chrome installed on the remote host is prior to 66.0.3359.170, and is affected by multiple vulnerabilities :

 - An unspecified flaw exists in the 'GlobalHandles::MakeWeak()' function in 'managed.h' that is triggered when handling managed objects. This may allow a context-dependent attacker to have an unspecified impact.
 - An overflow condition exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against the library or potentially allowing the execution of arbitrary code.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2018-6118     Ned Williamson discovered a use-after-free issue.

  - CVE-2018-6120     Zhou Aiting discovered a buffer overflow issue in the     pdfium library.

  - CVE-2018-6121     It was discovered that malicious extensions could     escalate privileges.

  - CVE-2018-6122     A type confusion issue was discovered in the v8     JavaScript library.

  - CVE-2018-6123     Looben Yang discovered a use-after-free issue.

  - CVE-2018-6124     Guang Gong discovered a type confusion issue.

  - CVE-2018-6125     Yubico discovered that the WebUSB implementation was too     permissive.

  - CVE-2018-6126     Ivan Fratric discovered a buffer overflow issue in the     skia library.

  - CVE-2018-6127     Looben Yang discovered a use-after-free issue.

  - CVE-2018-6129     Natalie Silvanovich discovered an out-of-bounds read     issue in WebRTC.

  - CVE-2018-6130     Natalie Silvanovich discovered an out-of-bounds read     issue in WebRTC.

  - CVE-2018-6131     Natalie Silvanovich discovered an error in WebAssembly.

  - CVE-2018-6132     Ronald E. Crane discovered an uninitialized memory     issue.

  - CVE-2018-6133     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6134     Jun Kokatsu discovered a way to bypass the Referrer     Policy.

  - CVE-2018-6135     Jasper Rebane discovered a user interface spoofing     issue.

  - CVE-2018-6136     Peter Wong discovered an out-of-bounds read issue in the     v8 JavaScript library.

  - CVE-2018-6137     Michael Smith discovered an information leak.

  - CVE-2018-6138     Francois Lajeunesse-Robert discovered that the     extensions policy was too permissive.

  - CVE-2018-6139     Rob Wu discovered a way to bypass restrictions in the     debugger extension.

  - CVE-2018-6140     Rob Wu discovered a way to bypass restrictions in the     debugger extension.

  - CVE-2018-6141     Yangkang discovered a buffer overflow issue in the skia     library.

  - CVE-2018-6142     Choongwoo Han discovered an out-of-bounds read in the v8     JavaScript library.

  - CVE-2018-6143     Guang Gong discovered an out-of-bounds read in the v8     JavaScript library.

  - CVE-2018-6144     pdknsk discovered an out-of-bounds read in the pdfium     library.

  - CVE-2018-6145     Masato Kinugawa discovered an error in the MathML     implementation.

  - CVE-2018-6147     Michail Pishchagin discovered an error in password entry     fields.

  - CVE-2018-6148     Michal Bentkowski discovered that the Content Security     Policy header was handled incorrectly.

  - CVE-2018-6149     Yu Zhou and Jundong Xie discovered an out-of-bounds     write issue in the v8 JavaScript library.

The remote host is affected by the vulnerability described in GLSA-201805-06 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the referenced CVE identifiers and Google Chrome       Releases for details.
  Impact :

    A remote attacker, by enticing a user to install malicious extensions,       could possibly escalate privileges, cause a Denial of Service condition,       or have other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

The version of Google Chrome installed on the remote host is prior to 66.0.3359.170. It is, therefore, affected by multiple unspecified vulnerabilities as noted in Chrome stable channel update release notes for May 10th, 2018. Please refer to the release notes for additional information.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 66.0.3359.170. It is, therefore, affected by a multiple unspecified vulnerabilities as noted in Chrome stable channel update release notes for May 10th, 2018. Please refer to the release notes for additional information.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:1446 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 66.0.3359.170.

    Security Fix(es):

    * chromium-browser: Heap buffer overflow in PDFium (CVE-2018-6120)

    * chromium-browser: Privilege Escalation in extensions (CVE-2018-6121)

    * chromium-browser: Type confusion in V8 (CVE-2018-6122)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for Chromium to version 66.0.3359.170 fixes the following issues :

Security issues fixed (boo#1092923) :

  - CVE-2018-6121: Privilege Escalation in extensions

  - CVE-2018-6122: Type confusion in V8

  - CVE-2018-6120: Heap buffer overflow in PDFium

  - Various fixes from internal audits, fuzzing and other     initiatives

The following bugs are fixed :

  - boo#1092272: Improved support for subpixel rending

Google Chrome Releases reports :

4 security fixes in this release :

- [835887] Critical: Chain leading to sandbox escape. Reported by Anonymous on 2018-04-23

- [836858] High CVE-2018-6121: Privilege Escalation in extensions

- [836141] High CVE-2018-6122: Type confusion in V8

- [833721] High CVE-2018-6120: Heap buffer overflow in PDFium.
Reported by Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team on 2018-04-17

- [841841] Various fixes from internal audits, fuzzing and other initiatives

ID	Name	Product	Family	Severity
120630	Fedora 28 : chromium (2018-94e1bc8c23)	Nessus	Fedora Local Security Checks	high
700357	Google Chrome < 66.0.3359.170 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
110820	Debian DSA-4237-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	critical
110327	Fedora 27 : chromium (2018-812b5d5a71)	Nessus	Fedora Local Security Checks	high
109930	GLSA-201805-06 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
109900	Google Chrome < 66.0.3359.170 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	high
109899	Google Chrome < 66.0.3359.170 Multiple Vulnerabilities	Nessus	Windows	high
109837	RHEL 6 : chromium-browser (RHSA-2018:1446)	Nessus	Red Hat Local Security Checks	high
109753	openSUSE Security Update : Chromium (openSUSE-2018-456)	Nessus	SuSE Local Security Checks	high
109750	FreeBSD : chromium -- multiple vulnerabilities (e457978b-5484-11e8-9b85-54ee754af08e)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-6120

high

Tenable Plugins

high

high

critical

high

high

high

high

high

high

high